S5Mark Is A 'VPN' That Is Actually A Rootkit In Disguise, Bitdefender Says

The best defense, as always, is constant vigilance against what you’re downloading, and from where.

- Mark Hachman

While a form of the Zacinlo rootkit has been active for several years, BitDefender said in June that it has adopted a more sinister appearance: as an anonymous “VPN” service, S5Mark, that worms its way into Windows 10 systems and can send screenshots of whatever you’re looking at to its control server.

While it’s not clear how many systems have been infected in the wild, BitDefender says that the majority of Zacinlo systems that have been attacked have been in the United States, and running Windows 10. Check out PCWorld’s roundup of the best VPNs (go.pcworld.com/ vp18) before downloading an untested version from a shady part of the web.