{
  "family": "mailcheck",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nMailCheck (often detected as HackTool.MailChecker, Riskware.MailCheck, or Trojan.AccountChecker) is a category of illicit utility software utilized by cybercriminals to perform automated, bulk validation of stolen email credentials (combo lists). These tools are a critical component of the underground credential stuffing ecosystem, allowing attackers to rapidly verify which stolen \"username:password\" pairs are currently active and valid for various email providers (Gmail, Outlook, Yahoo, etc.).\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMailCheck tools are not typically self-replicating malware. They are standalone executables or Python scripts downloaded intentionally by an attacker or a malicious insider who has acquired a database of stolen credentials from a dark web forum.\n\nUpon execution, the tool automates the credential validation process:\n<ul>\n<li><strong>Proxy Integration:</strong> To avoid rate-limiting, CAPTCHAs, and IP bans from the targeted email providers, MailCheck tools heavily integrate with massive lists of rotating SOCKS/HTTP proxies. This distributes the login attempts across thousands of IP addresses.</li>\n<li><strong>Automated Authentication (IMAP/POP3/SMTP/Web):</strong> The tool ingests the combo list and rapidly attempts to authenticate against the targeted email provider's servers. It may use standard mail protocols (IMAP/POP3) or attempt to interact directly with the provider's web login API.</li>\n<li><strong>Sorting and Output:</strong> The tool categorizes the results, generating text files separating the \"Valid\" (successful logins) accounts from the \"Invalid\" or \"Locked\" accounts. The attacker then uses the valid list for spamming, identity theft, or reselling on illicit markets.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of a MailCheck utility on a corporate endpoint is a critical indicator of active, financially motivated cybercrime. It signifies that the user (or an attacker controlling the machine) is actively engaging in credential stuffing attacks utilizing corporate network infrastructure, posing severe legal and reputational risks.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Legal and HR Escalation:</strong> Isolate the endpoint immediately, but do not power it off to preserve volatile memory. Because the tool is used for explicit fraud/hacking, this incident must be immediately escalated to HR and Legal counsel.</li>\n<li><strong>Forensic Chain of Custody:</strong> Treat the endpoint as a crime scene. A full forensic image of the hard drive must be captured to determine the origin of the combo lists and identify which specific email providers the attacker was targeting.</li>\n<li><strong>Network Auditing:</strong> Review the corporate firewall logs for massive spikes in outbound traffic to IMAP/POP3 ports or anomalous DNS requests to proxy services, correlating this activity with the infected endpoint.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.MailChecker",
    "Riskware.AccountChecker",
    "Tool.ComboChecker"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1110.004",
    "T1090"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:30:48Z",
  "type": "HackTool / Credential Harvester",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}