New image, password-stealing malware out

Victor Barreiro Jr.
Trend Micro reports two new malware types that steal images and passwords stored in browsers

MALWARE. Trend Micro reports mention two new malware forms possibly created by the same cybercriminals. (Image courtesy of Trend Micro)

MANILA, Philippines – Privacy theft may now become a larger cause of concern for common Internet users who love taking pictures and storing them on their computers, as well as those who store their passwords in their browsers.

Two reports published on the Trend Micro blog on November 2 and November 6 discuss new malware: one that copies image files and sends them to an FTP server, and another that steals the password information stored in the browser.

The image-stealing malware, known as TSPY_PIXSTEAL.A, copies all the .JPG, .JPEG and .DMP files on a computer, then connects to an FTP server that sends the first 20,000 to that server.

The  .JPG and .JPEG file types are associated with images, while the .DMP file types are memory dump files containing details regarding why a system has stopped unexpectedly.

The potential threats from the PIXSTEAL malware can include using the photos for blackmail and identity theft.

Scouring the photos for relevant information may also enable social engineering attempts and future attacks.  

The password-stealing malware, known as TSPY_PASSTEAL.A, steals login credentials. It then stores them as a text file.

As the Trend Micro blog elaborates, “Unlike most info stealing malware that logs keystrokes to gather data, PASSTEAL uses a password recovery app to extract passwords stored in the browser.”

This allows the malware to steal passwords even from sites that use secure connections, such as Facebook, Twitter, Amazon and online banking sites, and variants can take information from non-browser applications such as gaming client Steam.

Trend Micro believes that the same people are responsible for both malware types.

“Because of similarity in data extraction routine (FTP upload), writes Alvin John Nieto for Trend Micro, “PASSTEAL and PIXSTEAL were possibly created by the same cybercriminals.” –

Add a comment

Sort by

There are no comments yet. Add your comment to start the conversation.


Victor Barreiro Jr.

Victor Barreiro Jr is part of Rappler's Central Desk. An avid patron of role-playing games and science fiction and fantasy shows, he also yearns to do good in the world, and hopes his work with Rappler helps to increase the good that's out there.