Credential harvesting tool Legion targets additional cloud services

Legion hacker, a commercial malware tool, has widened its scope in targeting cloud services and can now compromise SSH servers and steal additional AWS-specific credentials, according to security firm Cado Security.

The tool's main goal is to harvest credentials and store configuration files.

Attackers can also hijack resources and launch mass email and SMS campaigns, primarily through hijacked Simple Mail Transfer Protocol (SMTP) credentials. The tool also attempts to brute-force credentials to gain access to databases and web host administration panels.