A backdoor Trojan known as SmokeLoader is deploying a customized WiFi scanning executable to triangulate the location of infected Windows devices. The malware,
Threat actors could use the geolocation data to track compromised systems. On August 8, 2023, Secureworks® Counter Threat Unit™ (CTU) researchers observed the Smoke Loader botnet dropping a custom Wi-Fi scanning executable to infected systems. CTU™ .
Deployed by the infamous SmokeLoader botnet, the location-tracking malware could be used for a host of follow-on cyberattacks or even physical targeting.