The Second Coming of the Fake Windows XP Activation Malware
Kardphisher, the data stealing Trojan that impersonates the Windows XP activation and that was launched back in 2007, has made a recent comeback. All PC users that have decided to stick with XP, as opposed to switching to Vista, are well advised to be on the lookout, especially since the Trojan was redesigned to look more like the genuine article.
The malware program known as Kardphisher is a Trojan that was first detected by security company Symantec, better known for their Norton Antivirus software, last year in April, and is used as a means to gather your personal credit card information. What is new in this 2.0 version of the malware? Kardphisher now employs a more genuine looking color scheme, meant to trick the user into giving up his credit card details; there is also improved software functionality, meaning that the Trojan will no longer give itself away by specifically asking for your PIN number.
There are several things that must be noted in regard to the “improved functionality feature”. If for example you figure out it is a bogus Windows activation program and enter a random email address, the Trojan has a built-in email validation program. There is also a credit card validation program as well, meaning you will not be able to feed the Trojan fake data. There is even a feature that detects the current Windows XP activation key and displays it in an attempt to make the malware look genuine.
What will happen if you are fooled by Kardphisher? Well, in order to do so you have to fill in all the requested fields, meaning that you will hand over the following data: name, address, email, phone number, credit card credentials, social security number, and even the date on which you were born. All this data is stored by the Trojan and sent out to an IRC channel; Kardphisher will then proceed to delete itself from your machine, giving you the impression that you were actually registering your Windows XP operating system and that everything went okay.
The malware program known as Kardphisher is a Trojan that was first detected by security company Symantec, better known for their Norton Antivirus software, last year in April, and is used as a means to gather your personal credit card information. What is new in this 2.0 version of the malware? Kardphisher now employs a more genuine looking color scheme, meant to trick the user into giving up his credit card details; there is also improved software functionality, meaning that the Trojan will no longer give itself away by specifically asking for your PIN number.
There are several things that must be noted in regard to the “improved functionality feature”. If for example you figure out it is a bogus Windows activation program and enter a random email address, the Trojan has a built-in email validation program. There is also a credit card validation program as well, meaning you will not be able to feed the Trojan fake data. There is even a feature that detects the current Windows XP activation key and displays it in an attempt to make the malware look genuine.
What will happen if you are fooled by Kardphisher? Well, in order to do so you have to fill in all the requested fields, meaning that you will hand over the following data: name, address, email, phone number, credit card credentials, social security number, and even the date on which you were born. All this data is stored by the Trojan and sent out to an IRC channel; Kardphisher will then proceed to delete itself from your machine, giving you the impression that you were actually registering your Windows XP operating system and that everything went okay.
