KICKIDLER EMPLOYEE MONITORING SOFTWARE ABUSED IN RANSOMWARE ATTACKS

Summary from the TLDR InfoSec newsletter

Kickidler is an employee monitoring tool that can capture keystrokes, take screenshots, and create videos of employees' screens. A new ransomware campaign operates by using Google Ads masquerading as ads for RVTools, a free Windows utility for managing VMware vSphere deployments. This leads users to download a trojanized version of the software that includes a PowerShell backdoor that deploys Kickidler on the device. The ransomware operator then monitors the victim's (likely an administrator) machine to collect credentials for sensitive systems and off-site cloud backups without detection.