{"id":32895,"date":"2020-01-21T14:19:32","date_gmt":"2020-01-21T14:19:32","guid":{"rendered":"http:\/\/3ca977fb-bd28-4451-aedf-e180834bbda4"},"modified":"2020-01-21T14:19:32","modified_gmt":"2020-01-21T14:19:32","slug":"ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/","title":{"rendered":"FTCODE ransomware is now armed with browser, email password stealing features"},"content":{"rendered":"<p>FTCODE ransomware is back with a fresh set of information-stealing capabilities targeting browsers and email services.&nbsp;<\/p>\n<p>First spotted back in 2013 <a href=\"https:\/\/nakedsecurity.sophos.com\/2013\/03\/05\/russian-ransomware-windows-powershell\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">by Sophos<\/a>, the malware &#8212; believed to be the handiwork of Russian threat groups &#8212; piqued researcher interest due to its reliance on PowerShell, a Microsoft scripting language designed for task automaton and network management.<\/p>\n<p>The ransomware has previously targeted Russian-speaking users, but since its inception, operators of the malware have expanded their horizons to include victims of other languages.&nbsp;<\/p>\n<p><strong>See also:&nbsp;<\/strong><a href=\"https:\/\/www.zdnet.com\/article\/new-ransomware-attack-targets-your-nas-devices-backup-storage\/\" target=\"_blank\" rel=\"noopener noreferrer\">New ransomware attacks target your NAS devices, backup storage<\/a><\/p>\n<p>In October 2019, the ransomware was linked to phishing and email campaigns <a href=\"https:\/\/www.certego.net\/en\/news\/malware-tales-ftcode\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">targeting Italian users<\/a> through documents containing malicious macros, a common way for cyberattackers to deploy exploit kits.<\/p>\n<p>According to Zscaler ThreatLabZ researchers Rajdeepsinh Dodia,&nbsp; Amandeep Kumar, and Atinderpal Singh, the malware is now being downloaded via VBScript, but is still based on PowerShell.&nbsp;<\/p>\n<p>&#8220;The FTCODE ransomware campaign is rapidly changing,&#8221; <a href=\"https:\/\/www.zscaler.com\/blogs\/research\/ftcode-ransomware--new-version-includes-stealing-capabilities\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">the team says<\/a>. &#8220;Due to the scripting language it was written in, it offers multiple advantages to threat actors, enabling them to easily add or remove features or make tweaks much more easily than is possible with traditionally compiled malware.&#8221;<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>What appears to be the latest version of the malware, 1117.1, lands on infected machines through the same attack vector &#8212; documents containing macros. However, these macros contain links to VBScripts that deploy the PowerShell-based FTCODE, disguised as a decoy .JPEG image file that lands in the Windows %temp% folder.&nbsp;<\/p>\n<p><strong>CNET:&nbsp;<\/strong><a href=\"https:\/\/www.cnet.com\/how-to\/sim-swap-fraud-what-it-is-why-you-should-care-and-how-to-protect-yourself\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">SIM swap fraud: What it is, why you should care and how to protect yourself<\/a><\/p>\n<p>In many respects, FTCODE acts as typical ransomware. Basic system information is harvested and sent to a waiting command-and-control (C2) server, and persistence is secured through a shortcut file in the startup folder that executes on reboot.&nbsp;<\/p>\n<p>FTCODE will then scan the infected system for drives with at least 50kb of free space and begin encrypting files with extensions including .das, .rar, .avi, .epk, and .docx. A ransom note is then posted. <a href=\"http:\/\/blog.ptsecurity.com\/2020\/01\/fileless-ransomware-ftcode-now-steals.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Positive Technologies says<\/a> the initial request is $500 but increases over time.<\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet3.cbsistatic.com\/hub\/i\/r\/2020\/01\/21\/ba07edc7-faea-421c-9196-c6a45bbf1899\/resize\/470xauto\/eb92609c0a606a8c33b5246ba8642e27\/screenshot-2020-01-21-at-13-48-03.png\" class alt=\"screenshot-2020-01-21-at-13-48-03.png\" height=\"auto\" width=\"470\"><\/span> <span class=\"credit\">ZScaler<\/span><\/p>\n<p>The latest version of the malware is also able to steal browser and email credentials, a significant update on past iterations.&nbsp;<\/p>\n<p>Internet Explorer, Mozilla Firefox, and Google Chrome browser information, alongside Microsoft Outlook and Mozilla Thunderbird email credentials, can be stolen and sent to the malware&#8217;s operators via the C2.&nbsp;<\/p>\n<p>Stolen data is encrypted with base64 and sent via an HTTP POST request, as noted by Positive Technologies.&nbsp;<\/p>\n<p>The researchers add in their report that the ransomware may also install the JasperLoader downloader, which can be used to deploy additional malicious payloads.&nbsp;<\/p>\n<p><strong>TechRepublic:&nbsp;<\/strong><a href=\"https:\/\/www.techrepublic.com\/article\/this-new-startup-aims-to-make-developers-love-security\/?ftag=CMG-01-10aaa1b\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">This new startup aims to make developers love security<\/a><\/p>\n<p>In related news, on Tuesday, Safebreach Labs reported the conclusion of an investigation into how ransomware could exploit the Microsoft Windows Encrypting File System (EFS) to encrypt and lock-up PCs.&nbsp;<\/p>\n<p>After developing <a href=\"https:\/\/www.zdnet.com\/article\/antivirus-vendors-scramble-to-fix-new-efs-ransomware-attack\/\" target=\"_blank\" rel=\"noopener noreferrer\">a concept malware variant<\/a> and successfully creating workable attacks, the researchers tested their ransomware against three popular forms of antivirus software, all of which failed to stop the threat. In total, 17 cybersecurity vendors received Proof-of-Concept (PoC) reports, the majority of which have now pushed out proactive software updates before such an attack is used in the wild.&nbsp;<\/p>\n<h3>Previous and related coverage<\/h3>\n<hr>\n<p><strong>Have a tip?<\/strong> Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0<\/p>\n<hr>\n<p>READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Encrypting your PC isn\u2019t enough &#8212; hackers want your email passwords, too.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":32896,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-32895","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>FTCODE ransomware is now armed with browser, email password stealing features 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"FTCODE ransomware is now armed with browser, email password stealing features 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-01-21T14:19:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png\" \/>\n\t<meta property=\"og:image:width\" content=\"470\" \/>\n\t<meta property=\"og:image:height\" content=\"398\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"FTCODE ransomware is now armed with browser, email password stealing features\",\"datePublished\":\"2020-01-21T14:19:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/\"},\"wordCount\":582,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/\",\"name\":\"FTCODE ransomware is now armed with browser, email password stealing features 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png\",\"datePublished\":\"2020-01-21T14:19:32+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/01\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png\",\"width\":470,\"height\":398},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"FTCODE ransomware is now armed with browser, email password stealing features\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"FTCODE ransomware is now armed with browser, email password stealing features 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/","og_locale":"en_US","og_type":"article","og_title":"FTCODE ransomware is now armed with browser, email password stealing features 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-01-21T14:19:32+00:00","og_image":[{"width":470,"height":398,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"FTCODE ransomware is now armed with browser, email password stealing features","datePublished":"2020-01-21T14:19:32+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/"},"wordCount":582,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/","url":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/","name":"FTCODE ransomware is now armed with browser, email password stealing features 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png","datePublished":"2020-01-21T14:19:32+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/01\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features.png","width":470,"height":398},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ftcode-ransomware-is-now-armed-with-browser-email-password-stealing-features\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"FTCODE ransomware is now armed with browser, email password stealing features"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/32895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=32895"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/32895\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/32896"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=32895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=32895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=32895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}