Connect with us

Hi, what are you looking for?



Researchers Flag FBot Hacking Tool Hijacking Cloud, Payment Services

The tool, called FBot, is capable of credential harvesting for spamming attacks, and AWS, PayPal and SaaS account hijacking.

Malware hunters at SentinelOne on Thursday flagged a newly discovered Python-based hacking tool being used by cybercriminals to hijack cloud platforms and payment services.

The tool, called FBot, is capable of credential harvesting for spamming attacks, AWS account hijacking and functions to enable attacks against PayPal and various SaaS accounts.

According to documentation from the company’s SentinelLabs research unit, Fbot is characterized by a smaller footprint compared to similar tools, indicating possible private development and a more targeted distribution approach.

SentinelLabs researcher Alex Delamotte dissected the internals of the attack tool and found features to target web servers and cloud services as well as Software-as-a-Service (SaaS) technologies that include Aws, Office365, PayPal, Sendgrid and Twilio.

While the tool is primarily designed for actors to hijack cloud, SaaS, and web services, Delamotte discovered a secondary focus on obtaining accounts to conduct spamming attacks. 

“The tool contains assorted utilities, including an IP address generator and port scanner. There is also an email validator function, which uses an Indonesian technology service provider to validate email addresses,” the SentinelLabs researcher said.

The anti-malware company also discovered several features that target payment services, including a PayPal Validator feature, a SendGrid API key generator, and features for harvesting key secrets. 

Delamotte recommends that organizations enable multi-factor authentication (MFA) for AWS services with programmatic access and set up systems to alert security operations teams when a new AWS user account is added to the organization.

Advertisement. Scroll to continue reading.

The researcher also suggests setting up alerts for new identities added or major configuration changes to SaaS bulk mailing applications.

Related: New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware

Related: US Gov Warning: Start Hunting for Iranian APTs That Exploited Log4j

Related: Researchers Crowdsourcing Effort to ID Mysterious Metador APT

Related: Urgent Fixes for Critical Flaws in Windows Kerberos, Hyper-V

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.