Trojan T9000 Bypasses Antivirus Suites to Spy on Skype Calls, Chats: Report

A newly discovered sophisticated backdoor Trojan named T9000 is said to be targeting Skype users. The Trojan steals information of a user by recording the conversation and capturing encrypted data. Furthermore, security researchers are warning that T9000 is also able to take screenshots of different applications on the victim's computer.

​Update​: A Microsoft spokesperson in an emailed statement to Gadgets 360 detailed the company's efforts in combating the Trojan, "To further protect our customers, we've added detection for the malicious software known as 'T9000' to Windows Defender. Customers that have installed security updates released in 2012 (MS12-060) and 2014 (MS14-033), either manually or by enabling automatic updates, will already be protected. Our recommendation is to enable automatic updates, which installs the latest security protections, and use the latest version of Skype."

T9000 is designed to collect information from the victim's system by eavesdropping on Skype application, wrote security researchers from Palo Alto Networks. It does so by recording video and audio calls and capturing all the chat messages. T9000 creates a folder called Intel on the victim's system where it stores all the stolen information.

T9000 is a new variant of the old T5000 malware family. Researchers noted that developers of T9000 have made it harder for a security suite to detect it. The sophisticatedly designed T9000 circumvents as many as 24 potential security suites on a system by altering its installation procedure.

"The malware goes to great lengths to identify a total of 24 potential security products that may be running on a system and customizes its installation mechanism to specifically evade those that are installed," the team wrote in a blog post. "It uses a multi-stage installation process with specific checks at each point to identify if it is undergoing analysis by a security researcher."

T9000 has been found targeting organisations in the United States, but researchers warn that the malware's functionality is intended for a broad range of users. A Skype user needs to be alerted about suspicious activities on their computer. Researchers noted that users must decline explorer.exe's request to access Skype app, as this apparently facilitates the attack.