Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:08 PM
Connect Directly

Zscaler Warns Of New iSpy Commercial Keylogger

Malware steals user data, license keys to popular applications.

Security vendor Zscaler has issued an alert on what it describes as a sophisticated new keylogger that is designed to capture every single keystroke and conduct extensive surveillance on an infected computer.

Dubbed iSpy, the keylogger is equipped to steal passwords, capture screenshots, and monitor clipboards and webcams on victim systems, Zscaler said in an alert this week.

The malware is customizable and can be tweaked to not only record keystrokes but also to recover passwords and the license keys to applications like Microsoft Office and Photoshop that may be running on a victim’s system. In addition, it collects data like username, Windows version and the details of antivirus software, browser version, and firewalls.

The iSpy keylogger malware then uses either the FTP, SMTP, or HTTP protocols to send the stolen data over to a remote command-and-control computer controlled by the attackers, the security vendor said.

Like many other malware tools, iSpy is distributed as a malicious attachment in spam email. It supports multiple features that are designed to make it hard to detect and delete. The encrypted payload itself is compressed using packers written in .Net, Visual Basic 6.0 and AutoIT, Zscaler said in its alert.

One of the packers that the company inspected contained what the vendor described as obfuscated zombie code apparently to slow down analysis of the malware. Some of the packers are digitally signed using mostly invalid digital certificates, the security vendor said. When installing on a machine, the iSpy keylogger malware employs multiple techniques to avoid detection by antimalware tools.

"iSpy keylogger contains advanced keylogger functionality to steal information, monitor the target user's system activity via screenshots, and act as a surveillance system for criminals by capturing video through an infected system's webcam,” says Deepen Desai, director of security research at Zscaler.

In addition to stealing user credentials from web browsers and popular applications installed on the system, a unique feature of this keylogger is to steal license keys for specific applications like Microsoft Office and Adobe Photoshop, Desai says.

"The motive here appears to be piracy. The authors will attempt to make money by selling these license keys in addition to user credentials,” he says.  

The iSpy malware samples that Zscaler has inspected in its cloud sandbox did not appear to be targeted in nature unlike some other recent commercial keyloggers like AgentTesla, he says.

ISpy is currently available in underground forums in the form of multiple subscription packages designed to appeal to criminals with varying degrees of technical abilities. The cheapest option is a $25 Bronze Package, which offers a one-month access to the malware, instant activation, free support and free updates. iSpy is also available in the form of a "small business" package priced at $35 for six-month access to the malware and six months of free support and updates. The most popular option apparently is a $45 package for one-year access, support, and upgrades.

“Overall, we are seeing a rise in malicious activity involving commercial keyloggers," Desai says. The tools make it very easy even for a naïve user with malicious intent to conduct successful attacks, he says.

Related stories:


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-13
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in th...
PUBLISHED: 2020-07-13
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the co...
PUBLISHED: 2020-07-13
An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.
PUBLISHED: 2020-07-13
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
PUBLISHED: 2020-07-13
A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version allows unauthenticated remote attackers to start a telnetd service on the device.