Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers

Researchers have identified a new malware called Speagle that parasitically abuses the Cobra DocGuard document security platform to steal data from targeted systems.

• •Speagle targets only systems with Cobra DocGuard installed, deliberately harvesting sensitive data and exfiltrating it through a compromised Cobra DocGuard server to disguise traffic as legitimate communications.
• •The malware collects system information, files from specific folders, and web browser history and autofill data in phases.
• •One variant includes functionality to toggle data collection types and search for files related to Chinese ballistic missiles like Dongfeng-27 (DF-27).
• •Speagle uses a legitimate Cobra DocGuard driver to delete itself from the host after execution, aiding in evasion.
• •