Now on Demand: Threat Detection and Incident Response (TDIR) Summit - All Sessions Available
Connect with us

Hi, what are you looking for?



Researchers Flag FBot Hacking Tool Hijacking Cloud, Payment Services

The tool, called FBot, is capable of credential harvesting for spamming attacks, and AWS, PayPal and SaaS account hijacking.

Malware hunters at SentinelOne on Thursday flagged a newly discovered Python-based hacking tool being used by cybercriminals to hijack cloud platforms and payment services.

The tool, called FBot, is capable of credential harvesting for spamming attacks, AWS account hijacking and functions to enable attacks against PayPal and various SaaS accounts.

According to documentation from the company’s SentinelLabs research unit, Fbot is characterized by a smaller footprint compared to similar tools, indicating possible private development and a more targeted distribution approach.

SentinelLabs researcher Alex Delamotte dissected the internals of the attack tool and found features to target web servers and cloud services as well as Software-as-a-Service (SaaS) technologies that include Aws, Office365, PayPal, Sendgrid and Twilio.

While the tool is primarily designed for actors to hijack cloud, SaaS, and web services, Delamotte discovered a secondary focus on obtaining accounts to conduct spamming attacks. 

“The tool contains assorted utilities, including an IP address generator and port scanner. There is also an email validator function, which uses an Indonesian technology service provider to validate email addresses,” the SentinelLabs researcher said.

The anti-malware company also discovered several features that target payment services, including a PayPal Validator feature, a SendGrid API key generator, and features for harvesting key secrets. 

Delamotte recommends that organizations enable multi-factor authentication (MFA) for AWS services with programmatic access and set up systems to alert security operations teams when a new AWS user account is added to the organization.

Advertisement. Scroll to continue reading.

The researcher also suggests setting up alerts for new identities added or major configuration changes to SaaS bulk mailing applications.

Related: New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware

Related: US Gov Warning: Start Hunting for Iranian APTs That Exploited Log4j

Related: Researchers Crowdsourcing Effort to ID Mysterious Metador APT

Related: Urgent Fixes for Critical Flaws in Windows Kerberos, Hyper-V

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Wendy Zheng named as CFO and Joe Diamond as CMO at cyber asset management firm Axonius.

Intelligent document processing company ABBYY has hired Clayton C. Peddy as CISO.

Digital executive protection services provider BlackCloak has appointed Ryan Black as CISO.

More People On The Move

Expert Insights