Fake HSBC payment advice spreads Formbook. The gz attachment of the “ayment Advice – Ref: [HSBC1057029141] /RFQ Priority Payment /  Customer Ref: [PI10771QT90]” email contains an exe file: the malware

A fake payment advice by HSBC is the bait for a new Formbook campaign.

The gz attachment of the “Payment Advice – Ref: [HSBC1057029141] /RFQ Priority Payment /  Customer Ref: [PI10771QT90]” email contains an exe file: the malware. Formbook, through the keylogger function, is able to acquire everything that the user types. Furthermore, it can steal email and browser credentials as well as take screenshots. Finally, it has the ability to remotely issue commands to the infected PC, such as downloading additional payloads or updating existing ones.