Qbot (QakBot) - what it is, how it steals credentials, and how to prevent it

Qbot (QakBot)

Qbot (QakBot)

What it is

Qbot - also known as QakBot - is a modular banking trojan targeting Windows. It steals credentials, cookies, and session tokens from browsers and mail clients, monitors web logins with injects, and can log keystrokes. Campaigns often start with reply-chain phishing and exploit existing email threads to look trustworthy. Qbot also acts as a loader to bring in additional payloads. Background and removal tips: https://gridinsoft.com/threats/qbot

Why it matters

Stolen sessions and passwords enable account takeovers and fraudulent transfers. As a loader, Qbot can hand off access to other malware, raising the risk of business email compromise and wider breaches.

How it works 

  • Entry: phishing emails with malicious attachments or links, often in real conversation threads.

  • Establish: drops in AppData/LocalAppData, sets autoruns via Run keys or Scheduled Tasks.

  • Steal: harvests browser data, cookies, tokens, and mail client creds; may log keys and take screenshots.

  • Persist and spread: updates itself, talks to C2, and can deliver follow-on payloads.

Red flags

  • Unusual replies in existing email threads that include attachments or macro-enabled docs.

  • New tasks or Run keys pointing to random-named files in AppData.

  • Sudden logins from new locations despite MFA, or accounts staying logged in after password resets.

  • EDR hits for credential access, LSASS scraping attempts, or browser data grabs.

Prevent it

  • Block macro-enabled docs and ZIPs from unknown senders; use attachment sandboxing.

  • Enforce phishing-resistant MFA and rotate tokens by signing out all sessions after resets.

  • Disable Office macros from the internet and monitor for suspicious Scheduled Tasks.

  • Keep endpoints patched and run reputable anti-malware with web filtering; isolate and reimage if integrity is uncertain.

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

      • Related Articles

      • PSW.Stealer (Trojan-PWS)

        What it is A password-stealing trojan for Windows that harvests credentials and other sensitive data, then exfiltrates it to the attacker. See our overview for defenders for details. Why it matters Once stolen, credentials enable account takeovers, ...

      • Banker Trojan

        What it is A banker trojan is malware built to steal money from online banking. It sneaks onto a PC, watches logins, and can secretly redirect you to fake pages or overlay real ones to grab passwords, 2FA codes, and payment details. It often hides by ...

      • Remote Access Trojan (RAT)

        What it is A Remote Access Trojan is malware that pretends to be legit software but secretly installs a back door. Once running, it gives an outsider admin-level control of the device: they can browse files, capture screens and keystrokes, turn on ...

      • Ramnit

        What it is Ramnit is a Windows file-infecting worm with trojan capabilities. It can inject itself into EXE and DLL files, add malicious code to HTML pages, and spread via removable drives and network shares. Once established, it deploys backdoors, ...

      • LokiBot (Loki Password Stealer)

        LokiBot (Loki Password Stealer) What it is LokiBot is a credential-stealing trojan that targets Windows and Android. It grabs passwords, cookies, and wallet data, can take screenshots, and sometimes opens a backdoor for more malware. Technical ...