Skype wiretap Trojan revealed

newsguy 1 274 Views

Symantec has detected a new Trojan which targets Skype users in order to monitor and record conversations made using the Internet telephony service. Apparently the source code for this particular Trojan, called Pesky Spy, is already being touted around the usual places where the bad guys can pick up such things.

It would appear to work by using the Windows API hooks that are intended for audio applications, such as Skype. The audio processes are monitored, calls recorded as relatively small MP3 files, and transferred quickly to anywhere on the Internet before the victim even knows their calls are being tapped. In fact, before the conversation even hits Skype.

Symantec explains that "Because the Trojan listens in the data traveling between the Skype process and the audio device, it gathers the audio independently of any application-specific protocols or encryption applied by Skype when it passes voice data at the network level. Essentially, it sits below these security measures, recording the audio at the Windows level—before outbound audio from the microphone gets to Skype and after incoming audio leaves Skype and reaches the speakers."

Skype is said to be aware of the Trojan, and is advising that users ensure their anti-virus and firewalls are up to date and operating properly.

Dani AI

Generated

This thread (thanks to for flagging the report) calls out a Skype-targeting audio-capture Trojan. The material below focuses on practical, OS-level detection, containment and cleanup steps you can use today, plus short hardening measures to reduce the risk of similar attacks in the future.

Start by containing the machine and preserving evidence

  • Immediately isolate the PC from the network (unplug or disable NIC/Wi‑Fi) to stop exfiltration.
  • If the system may require investigation, create a disk image before changing anything.
  • If forensic work is not required, proceed to cleanup using offline tools or a clean rescue environment.

Quick detection checklist and useful tools

  • Look for unexpected startup items, services or scheduled tasks (use Autoruns or Windows Task Scheduler).
  • Monitor live network connections and map PIDs to executables (see commands below). Identify unknown remote endpoints or short-lived outbound connections.
  • Inspect running processes and loaded modules for injections (Process Explorer, ListDLLs). Watch for nonstandard DLLs loaded into audio or comms processes.
  • Search for recently created temporary files or unusual artifacts in user temp and profile folders.
  • Run full offline scans with reputable anti-malware rescue media before rebooting to normal mode.

Commands you can run as an admin to gather immediate evidence

netstat -ano
netstat -b            (requires admin)
tasklist /FI "PID eq 1234" /FO LIST
powershell -Command "Get-Process -Id 1234 | Select-Object -ExpandProperty Modules | Select-Object ModuleName, FileName"
powershell -Command "Get-ChildItem -Path $env:TEMP -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-2) } | Select-Object FullName, Length, LastWriteTime"

Cleanup and longer-term hardening

  • If you cannot confidently remove all traces, reinstall the OS from known-good media and restore data from clean backups.
  • Change all credentials used from the compromised host and enable 2FA where possible. Assume sensitive data may be exposed.
  • Limit microphone access (use OS privacy settings or hardware mute), run with least privilege, and consider application whitelisting for critical machines.
  • Keep the OS, drivers and security software patched, and use endpoint protection that includes behavioral detection.

If calls involve highly sensitive material, preserve logs and consider professional incident response.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview