Yellow Cockatoo

The SolarMarker malware, also known as Yellow Cockatoo, Polazert, and Jupyter Infostealer, has been a persistent threat since its inception in 2020. It has steadily evolved over the years, posing significant risks to sectors such as education, healthcare, and small to medium-sized enterprises (SMEs). The malware uses sophisticated techniques to infiltrate systems, often leveraging manipulated search engine optimization (SEO) tactics and malvertising as initial access vectors. These strategies trick users into downloading it from dubious websites when they are searching for popular software. By November 2023, attacks leveraging a new version of the Jupyter information-stealing malware had emerged, demonstrating increased stealth capabilities. This development was reported by various cybersecurity outlets, including The Hacker News. VMware's Carbon Black threat research team also identified Jupyter as one of the top 10 info stealers targeting corporate networks. This highlights the malware's widespread impact and its continued evolution to stay ahead of security measures. Yellow Cockatoo's functionality is not limited to just infiltrating systems; it also serves as a backdoor to machines and harvests a variety of credential information. This includes computer name, user's admin privileges, cookies, web data, and browser password manager information. More alarmingly, it can extract sensitive data from victim systems, such as logins for crypto-wallets and remote access apps. Given these capabilities, the persistence technique employed by Yellow Cockatoo has become a subject of extensive analysis in the cybersecurity community.