Loading story…
Trend Micro reported that the TrickBot banking trojan added a new password-grabber module, extending the malware’s capabilities beyond its established role in financial fraud and post-compromise activity. The module was designed to harvest stored credentials from infected systems, giving operators another way to steal account access and deepen persistence inside victim environments.
The update underscored TrickBot’s continued evolution as a modular malware platform, with new components allowing attackers to tailor infections for credential theft and broader follow-on intrusion. By adding password collection to its toolkit, TrickBot increased the risk of account compromise across enterprise and consumer systems and strengthened its value as a flexible malware service for cybercriminal operations.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing a new TrickBot capability: a password grabber module. The reference indicates the module was observed by the time of the report, but provides no additional dated milestones in the supplied content.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **TrickBot** evolved well beyond its origins as a banking trojan into a modular intrusion platform used for credential theft, lateral movement, and ransomware operations. Earlier campaigns delivered TrickBot through phishing lures such as fake payroll emails, malicious ZIP files, Windows shortcut downloaders, and macro-enabled Word documents, often abusing legitimate services including SendGrid, Google Docs, and Google Drive. Once installed, the malware established persistence through scheduled tasks or the Windows Startup folder, used process hollowing and `rundll32.exe` for execution, collected system and browser data, and fetched additional modules for password theft, network reconnaissance, and command-and-control activity. The malware’s role in larger enterprise attacks became more serious as defenders linked TrickBot activity to **Ryuk** and later **Conti** ransomware operations, as well as Anchor-related payload delivery through modules such as **mexec**. Network analysis showed TrickBot using HTTPS/TLS command-and-control on uncommon ports, HTTP exfiltration, and even lateral movement to domain controllers via SMB exploitation. Eclypsium and AdvIntel also disclosed a new **TrickBoot** module that probes Intel-based systems for UEFI/BIOS write protections and firmware weaknesses, creating a potential path for stealthy persistence in SPI flash or destructive device bricking, marking a significant escalation from conventional malware delivery to firmware-level attack capability.
Aug 15, 2026
TrickBot operators continued to expand the malware’s modular toolkit with components for credential theft, Remote Desktop Protocol brute-forcing, and network reconnaissance. Reporting on the `rdpscanDll` module showed it could receive targets, usernames, password candidates, and operating modes from command-and-control servers, then generate tailored credential guesses by transforming usernames, domains, hostnames, and IP-derived data rather than relying on a static password list. Separate analysis of TrickBot’s password-grabber updates found the malware targeting browser credentials, cookies, Active Directory data, and PuTTY SSH secrets, while also attempting to collect OpenSSH private keys and OpenVPN credentials and configurations from infected Windows systems.
Aug 15, 2026
**TrickBot** was updated to abuse Windows User Account Control on multiple versions of Windows, letting the malware launch with elevated privileges without showing a visible prompt. Researchers reported that the trojan used the **`fodhelper.exe`** auto-elevation technique on Windows 10 and **CMSTPLUA** on Windows 7, then quickly shifted to a newer Windows 10 bypass that abused **`wsreset.exe`** through registry changes under **`HKCU\Software\Classes`**. The changes allowed TrickBot to run more quietly, evade user suspicion, and weaken host defenses while maintaining administrative access. The malware’s expanded privilege-escalation capability supported a broader credential-theft and post-compromise toolkit already seen in earlier TrickBot campaigns. Fortinet’s analysis of the **`pwgrab`** module showed TrickBot stealing saved passwords, browser data, autofill information, and credentials from applications including **Outlook**, **FileZilla**, and **WinSCP**, while persisting through scheduled tasks and exfiltrating data over HTTP. Reporting also noted TrickBot’s ability to spread laterally, target Active Directory data on domain controllers, and provide access that could later be used to deploy **Ryuk ransomware**.
Aug 15, 2026