A new keylogger called Phoenix that started selling on hacking forums over the summer has now been linked to more than 10,000 infections. The malware tries to stop 80 security processes before it starts running to remain undetected. Phoenix also steals credentials within seconds, there is no need for a persistent after boot infection. Phoenix has also gained an aggressive anti-AV and anti-VM. What this does is keeps the malware from being detected. In the article there’s a large list of all the things that Phoenix will shut down in order to go unseen. Many of these are well known security systems.

https://www.zdnet.com/article/new-phoenix-keylogger-tries-to-stop-over-80-security-products-to-avoid-detection/

Topic