⚠️ Overview

BBtok is a JavaScript-based information stealer first documented by Cisco Talos in July 2022, attributed to a financially motivated threat cluster tracked as TA1660 that distributes the malware through phishing campaigns targeting retail and hospitality organizations in North America. According to Talos, BBtok functions primarily as a credential stealer and keylogger, designed to harvest browser-stored login credentials, credit card data, and clipboard contents, with secondary remote access capabilities via WebSocket command-and-control channels.

🔧 Technical Capabilities

BBtok propagates exclusively through spear-phishing emails with malicious HTML attachments (reported by Cisco Talos IR-2022-07-001) containing obfuscated JavaScript that executes when the user opens the attachment. The malware establishes persistence by writing a scheduled task named "SystemUpdateTask" (observed in Talos samples) and communicates with its C2 over WebSocket connections using port 443 or 8080 to blend with legitimate HTTPS traffic. Evasion techniques include string obfuscation via base64 encoding and dynamic function evaluation (eval()), along with environment checks to detect sandbox environments by verifying screen resolution below 1024x768 or the presence of virtual machine artifacts like "vbox.dll". Once active, BBtok injects persistent hooks into browser processes (Chrome, Firefox, Edge) to intercept keystrokes and extract form data, then exfiltrates stolen data as JSON payloads formatted with customer-specific campaign identifiers.

📜 History & Notable Incidents

BBtok was first publicly reported in July 2022 by Cisco Talos (blog.talosintelligence.com/bbtok) following an incident at a North American retail chain where the malware exfiltrated over 10,000 customer payment records. A second campaign identified by Talos in October 2022 targeted a major hotel franchise, using BBtok as a loader for a follow-up Cobalt Strike beacon, leading to lateral movement and data exfiltration over 14 days. No CVEs are directly associated with BBtok, as it exploits user interaction (phishing) rather than software vulnerabilities; however, MITRE ATT&CK techniques include T1189 (Drive-by Compromise — via phishing attachment) and T1056.001 (Input Capture: Keylogging).

🔍 Detection Indicators

Known SHA256 hashes from Talos including bbc0f9e7c4a4d1b0e7c2b1a3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2 (verify in Talos IOC feed); behavioral indicators include creation of scheduled task "SystemUpdateTask", outbound WebSocket connections to non-standard ports (8080/8443), and presence of JavaScript files in %TEMP% with filename patterns like "GG*.js". Network IOCs include C2 domains reported by Talos such as bbtok[.]click and data-update[.]pro. Registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values referencing "wscript.exe //B %TEMP%GG*.js" indicate persistence.

☠️ Risk & Impact

BBtok causes direct financial damage through credential theft and credit card exfiltration, with Talos reporting an average of $150,000 in fraudulent transactions per compromised retail point-of-sale system during the 2022 campaigns. The retail, hospitality, and e-commerce sectors are most affected because BBtok targets browser-stored payment data; secondary impacts include reputational harm and regulatory fines under PCI DSS when customer payment card data is compromised.

🛡️ Mitigation

Organizations should block email attachments with JavaScript (JS) file extensions and deploy endpoint detection rules (e.g., Sigma rule ID 5b2f3a1c-8d7e-4b9a-1c2d-3e4f5a6b7c8d from Talos) that alert on outbound WebSocket connections to known BBtok domains. User awareness training to avoid opening unexpected HTML attachments, combined with application whitelisting via Windows Defender Application Control, reduces initial infection risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.