Pro-government hackers allegedly targeted Syrian opposition with a fake Anti-Hacker tool that installed spyware on their computers, according to the Electronic Frontier Foundation.
The Anti-Hacker tool promises to provide "Auto-Protect & Auto-Detect & Security & Quick scan and analysing." but installs infamous DarkComet RAT instead.
The Trojan allows hackers to capture webcam activity, disable some antivirus settings, record key strokes, steal passwords, and send sensitive information directly to the attackers.
According to the report, the Fake Anti-hacker tool has been posted in Facebook page with title "we are here to save the world". The Facebook group includes a link to a website.
On August 1, Antivirus softwares are not able to detect the DarkComet version. However, the DarkComet Removal Tool provided by DarkCoderSc(developer of Darkcomet) is able to detect the malware.
"Syrian Internet users should be especially careful about downloading applications from unfamiliar websites."said EFF representative Eva Galperin. "The AntiHacker website showed many signs of being illegitimate, including prolific abuse of English spelling and grammar, but this campaign demonstrates that while Syrian activists are becoming more savvy about efforts to trick them into downloading malware, attackers are also becoming more sophisticated."
