Attackers leveraged phishing emails using contract-themed DocuSign lures that included PDF attachments, which when opened fetches an installer file that eventually triggers the loading of the CHAVECLOAK malware, a report from Fortinet FortiGuard Labs revealed. After determining whether targeted machines are based in Brazil, CHAVECLOAK proceeds to create a command-and-control server connection and commences various activities that would enable the exfiltration of users’ credentials and other sensitive information, as well as the tracking of their traditional banking and cryptocurrency accounts.

Source: SC Magazine