Formbook Spyware Surge: Rising Threat in the Czech Republic – What You Need to Know

Formbook is not a new threat, security experts have been warning about this uninvited visitor for several years. It attacks in waves, which is why it is not wise to underestimate this threat.

And now, it is clear that a big wave is coming, as can be seen from the latest statistics from the antivirus company Eset. This uninvited visitor was very active at the end of this year, when it increased from 4.14% in January to 9.61% in February. Since then, however, he was constantly weakening. In March, its share was 7.36%, in April 3.35%, and in May it was only 2.88%.

But then there was a turning point. It is obvious that the cybercriminals were just tweaking their attack campaigns to deliver this malware to more victims. In June, the share among other risks was already 4.39%, and in July – according to the latest published statistics – even 10.74%.

Currently, Formbook is already behind every tenth detected attack and is boldly catching up with the most widespread threat, which is currently the Tesla Agent. Previously spyware Novinky.cz warned already.

It remains to be seen whether there will be another rise or, on the contrary, a fall, in the coming weeks. However, a warning against this malicious code is definitely in order.

Formbook is stealth malware that steals credentials from web browsers, takes screenshots, tracks keystrokes, and can download and execute files based on commands from a command and control server. The malware only attacks Windows machines.

Meanwhile, users may not even know that Formbook is attacking their phone or tablet. “He uses a number of tricks and techniques to avoid detection. It is usually spread through phishing e-mails and attachments, so the best way to prevent infections is to keep a close eye on all e-mails that look suspicious or that come from unknown senders,” Check Point security expert Tomáš Růžička previously warned.

The Spyware Formbook was distributed mostly in July via spam email attachments. One of them was the link “Custom Clearance 5816641785332.exe” in the Czech Republic.

As can be seen from the name of the link, cybercriminals attack with Formbook not only in the Czech Republic, but usually in enterprises around the world. According to Eset security experts, Czech translations of this threat are not very common, but the increasing number of discoveries deal specifically with the situation in the Czech Republic.

At the same time, the .exe extension should be a warning to users that they should not open the link at all. It indicates an executable file. Such attachment must be deleted immediately, including, of course, the offending email.