Snake Keylogger slithers into Windows, evades detection with AutoIt-compiled payload

A new variant of Snake Keylogger is making the rounds, primarily hitting Windows users across Asia and Europe. This strain also uses the BASIC-like scripting language AutoIt to deploy itself, adding an extra layer of obfuscation to help it slip past detection. Snake Keylogger is a Microsoft .NET-based data stealer. As with earlier versions of the malware, once this software nasty gets onto a victim's PC, typically as an attachment to a spam email, this variant logs keystrokes, captures screenshots of the desktop, and collects clipboard data to steal credentials, credit card details, and other sensitive data. The keystrokes can include usernames and passwords typed into browsers Chrome, Edge, and Firefox. After slurping up this info, Snake Keylogger funnels the loot to its command-and-control server using SMTP email, Telegram bots, and HTTP POST requests. According to Fortinet's malware hunters, the new variant's executable file is an AutoIt-compiled binary, designed to unpack and run the keylogger when opened. To us, it appears someone's taken the core malware as a payload and wrapped it in a self-contained AutoIt binary. AutoIt is a freeware scripting language used to automate tasks on Windows systems. It is popular among cybercriminals because it can generate standalone executables, some of which evade traditional antivirus solutions. "The use of AutoIt not only complicates static analysis by embedding the payload within the compiled script but also enables dynamic behavior...