Fraudsters are playing a different kind of card game

The now-notorious arsenal of ‘Nigerian’ tricks has been enriched with yet a new scam.

A Peter Gamba (or Gamaba?) from Uganda is asking for help: in his homeland he faces the threat of persecution for his sexual orientation. The sender claims he is threatened with jail or even death. But he has money – $3,300,000. The message then follows the usual scenario – you take his money, put it to your bank account and get 20% of it in return for your help.

Minority discrimination is a very topical issue today (especially in the US where a significant proportion of English-speaking Internet users live). It is almost impossible to avoid this topic and almost everyone has their own opinion on the issue. So the criminals know what they are doing: even if some of the recipients turn out to be conservative champions of more traditional values, there’s bound to be someone who sympathizes with this unfortunate citizen of Uganda facing persecution.

Persecuted widows of overthrown presidents and prime ministers can still be encountered online, though most Internet users are wise to this type of story. This has forced the cybercriminals to look for new ways to arouse sympathy and, of course, greed.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.