{
  "family": "frethog",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nFrethog (often classified as PWS:Win32/Frethog) is a malicious Password Stealer (PWS) Trojan engineered to covertly harvest and exfiltrate sensitive authentication credentials from compromised Windows systems. Unlike broad-spectrum botnets, Frethog acts as a precision data-harvesting tool, specifically targeting online gaming accounts, FTP credentials, and browser-stored passwords to facilitate immediate account takeover and financial fraud.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nFrethog is typically distributed via spear-phishing campaigns, bundled with cracked software or \"cheats\" on peer-to-peer gaming networks, or deployed as a secondary payload by exploit kits.\n\nOnce executed, Frethog operates silently to harvest data:\n<ul>\n<li><strong>Targeted Credential Extraction:</strong> Frethog actively searches for and parses the local credential databases of major web browsers (Chrome, Firefox, Internet Explorer). It is also notoriously known for specifically targeting the configuration files of popular online games (like World of Warcraft or Steam) and FTP clients to steal session tokens and passwords.</li>\n<li><strong>Keylogging Capabilities:</strong> Some variants incorporate API hooking (e.g., `SetWindowsHookEx`) to record keystrokes, ensuring they capture passwords even if they are not permanently saved in the browser or application.</li>\n<li><strong>Data Exfiltration:</strong> The harvested credentials, along with basic system reconnaissance data, are compressed and rapidly exfiltrated to the attacker's Command and Control (C2) server, usually via HTTP POST requests or sometimes via automated email (SMTP).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Frethog infection is a critical security incident that immediately compromises user identity and access. The theft of corporate credentials (if the user utilizes the same passwords across personal and work accounts) allows attackers to bypass perimeter security, potentially leading to unauthorized access to enterprise VPNs or cloud infrastructure.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Endpoint Isolation:</strong> The highest priority is to disconnect the infected endpoint from the network to halt the active exfiltration of the stolen credentials.</li>\n<li><strong>Global Credential and Session Reset:</strong> It must be assumed that all passwords and session tokens present on the machine have been stolen. A mandatory, immediate reset of all associated enterprise passwords is required. The user must be advised to reset all personal accounts as well.</li>\n<li><strong>Complete Re-imaging:</strong> To ensure no hidden persistence mechanisms or secondary backdoors remain, the compromised endpoint must undergo a complete bare-metal wipe and re-image from a trusted baseline.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "PWS:Win32/Frethog",
    "Trojan.PWS.Frethog",
    "Infostealer.Frethog"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1056.001",
    "T1005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:16:31Z",
  "type": "Trojan / Password Stealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}