New MultiloginBot Phishing Campaign

Zscaler ThreatLabz describes a live phishing campaign that clones the Multilogin website (domains multilogin-uk.com and multilogin-us.com) to trick users into installing a malicious .NET installer which deploys an info-stealer. The malware creates persistence, collects IP, browser autofill, cookies, and stored credentials (including Firefox via nss3.dll), archives the data to a ZIP and exfiltrates it to a Telegram bot; the report includes MD5 hashes, phishing domains, MITRE ATT&CK mappings, and mitigation guidance.