Ransomware 'Fantom'
Disguised as a Windows update
A new Windows malware called 'Fantom' is trying to gain access to its victims' computers using a particularly sneaky trick: The malware tricks the user into believing it is a critical Windows update.
If the user wants to keep his Windows version of Microsoft up to date, he installs the blackmail Trojan instead of the supposed update. While 'Fantom' imitates the typical Windows update installation window on the screen, the malware encrypts its victim's hard disk in the background. As soon as the program has finished, it informs the user what has actually happened to their computer. An HTML document with the blackmailing message is opened. According to its own information, the malware uses RSA-4096 and AES-256 encryption to make the data unreadable for its victims.
According to 'Bleeping Computer', the malware cannot be stopped once it has been started. Although the window with the installation notice can be closed, the encryption continues to run in the background. As with other blackmail Trojans, the user is asked to transfer money for the "decryption service" once the attack has been successful. The blackmailers urge users to hurry, as the captured keys for the systems will be destroyed after a week.










