Advanced Intel’s Vitali Kremez traced a mistake by TrickBot malware, wherein it mistakingly left warning messages on the victim's machine saying that they have been attacked.
TrickBot is a notorious malware usually distributed via spam mails; after infecting the system it downloads various files and modules to run and seize domain's Active Directory Services database, harvest browser passwords, and cookies, steal OpenSSH keys. It is also known to often give access to ransomware operators like Ryuk and Conti on the infected network.
This mistake by TrickBot occurred during the testing of their password-stealing "grabber.dll", this particular strain steals passwords, browser credentials, cookies from browsers like Google, Internet Explorer and Microsoft Edge. During the testing of this grabber.dll module, this particular warning message was issued on the attacked system revealing that some information has been gathered from the browser defeating the purpose.
Warning
"You see this message because the program named grabber gathered some information from your browser. If you do not know what is happening it is the time to start worrying. Please, ask your system administrator for details."
Kremez believes these modules are from TrickBot as they are coded in their fashion and that they were testing the new model and forgot to remove the warning while releasing.
This isn't TrickBot's first stunt, rather this malware has made headlines quite a few times in 2020 itself. In mid-June, TrickBot ran a fake Black Lives Matter email campaign that installed the malware. In another case, Conti and Ryuk ransomware were also found to be running TrickBot structure
To the victims who received this warning message, Kremez advices them to disconnect their machine from the network immediately and then perform a virus scan. Once the malicious malware is eliminated they should change all the login credentials that were saved on the browser.