What is QakBot (QBot) Malware?

QakBot (QBot) Malware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Banking credentials; initial access for ransomware operators

Source Attribution

Origin: MITRE
Source: CISA · FBI takedown 2023
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA · FBI takedown 2023 · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2008-12 discovered QakBot first observed
2023-08 updated FBI-led takedown disrupted infrastructure

Quick Answer

QakBot spreads through phishing email threads, drops Cobalt Strike beacons and provides network access for human-operated ransomware campaigns.

Definition

QakBot is a veteran banking trojan that steals credentials via browser injection and has become a common initial-access vector for ransomware operators.

Overview

QakBot is a veteran banking trojan that steals credentials via browser injection and has become a common initial-access vector for ransomware operators.

Behavior

Browser injection credential theft
Email thread hijacking phishing
Cobalt Strike initial access

First Seen

2008-12

Target

Banking credentials; initial access for ransomware operators

Techniques: T1566, T1497, T1016
Campaigns: n/a
Related CVEs: CVE-2020-1472

Malware Intelligence

Family: QakBot (QBot) Malware

Aliases: QakBot, QBot, Pinkslipbot

Techniques: T1566, T1497, T1016

Targets: Banking credentials; initial access for ransomware operators

Behavior:

Browser injection credential theft
Email thread hijacking phishing
Cobalt Strike initial access

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating QakBot (QBot) Malware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about QakBot (QBot) Malware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.