Cybercrime, the mysterious malware from Türkiye is SnakeKeylogger/StormKitty
The lnk “Alıntı 2589984” email attachment starts the infection chain by running a Powershell script. Stolen data is exfiltrated via Telegram API.
Cybercrime, Stormkitty/SnakeKeylogger campaign via Garanti BBVA
2 identical “Hesap hareketleriniz” emails contain the same r01 attachment, inside which there is an exe file: the malware. Stolen data is exfiltrated via Telegram API.