It is safe to assume that many individuals have been infected by this campaign although at the moment we are unable to know exactly how many,” said Amit Serper, Cybereason’s vice-president of security, in a disclosure blog. “This investigation surfaced almost 1,000 njRat samples compiled and built on almost a daily basis. The firm believes the campaign has been running for a considerable length of time and appears to be the product of a so-called “malware factory” which is churning out new iterations of the various compromised tools on an almost daily basis, possibly using some degree of automation.

These tools are being posted on various underground forums and websites to bait other hackers into falling “victim” to njRat. The new campaign spreads njRat by injecting it into downloadable hacking tools and other installers, said Cybereason. If opened, NjRat takes over the victim’s machine and can be used to extract system information, execute and manipulate files, open remote shells to let attackers use the command line, record from cameras or microphones, log keystrokes, and steal stored passwords, among other things. The campaign exploits the well-known and widely used njRat trojan – which is also known as Bladabindi – which was developed by Middle Eastern threat groups between seven and eight years ago.

Trojan maker take over computer