Malicious payloads embedded in Procolored printers

Digital printing solutions provider Procolored has offered printers with software drivers compromised with the XRed remote access trojan and the SnipVex clipbanker tool, reports GBHackers News.

Keylogging, screenshot capturing, file downloading, and remote command execution capabilities have been enabled by the XRed backdoor, while SnipVex facilitated the compromise of cryptocurrency assets, according to YouTuber Cameron Coward of the Serial Hobbyism channel, who discovered the malware infections. While XRed's exploitation has been limited by command-and-control servers that have been offline for more than a year, SnipVex presents a more significant security risk with .exe file targeting, as well as its usage of an infection marker that helps conceal malicious activity. Procolored has already released clean software packages addressing the issue, which may have stemmed from USB-based software transfers, after initially rejecting the malware detections as false positives. Immediate system reformats and operating system reinstallations have been recommended for those whose systems may have been compromised.