In Russia, a mutant attack was recorded using the new Trojan Efimer, capable of stealing financial resources, replacing cryptocurrencies and collecting passwords into websites. This has been reported to “gazeta.ru” in the press service of “Kaspersky's laboratory”.
According to the company's experts, the main purpose of the toxic program is the theft and replacement of cryptocurrencies, however, by using additional commands, it can also choose a password for WordPress websites and collect electronic addresses to send more toxic letters. The efforts of such attacks were recorded in some countries, including Russia.
The Efimer distribution campaign is characterized by the attackers to attack both private and company users. For ordinary users, the Torrent files are used as a mask for popular films, while the Fisching letters are sent to companies. The first versions of this Trojan appeared, perhaps, in October 2024 and spread through hacked WordPress websites. This program continues to be used to date, but in the summer of 2025, the attackers began to proactively send trojan with E -Mail.
For distribution via WordPress websites, attackers are looking for low -level protection resources, select passwords and then publish messages on them with recently released movies. Messages contain references on parking with Torrent files, the inner toxicity in camouflage is concealed according to a regular player.
In June 2025, experts from the Kaspersky Laboratory revealed a new wave of Trojan's distribution through the company's mailing addresses. A victim can become a small and large business. Fishing letters contain mistakes that the lawyers of a certain corporation have found a word or phrase, believed to have been registered by this organization under the name of the recipient. The attackers suggest not to sue if the recipient changes the name of the domain, or even is willing to change it. Moreover, the domain name is not specified in the letter. Details of violations and proposals for redemption may be considered to be found by opening the attachment. However, a trained archive contains a toxic file attached to the letter. When it was launched, the computer was infected and the user only saw an error message.
Kaspersky laboratory has successfully detected this harmful software, identifying it according to different modifications of Efimer, related to the functions of a drip, bank triangle and spy and protecting users from it.