Cryptocurrency, Download and Information Security

Free Download Manager backdoored to serve Linux malware for more than 3 years

Security Affairs

SEPTEMBER 14, 2023

Researchers discovered a free download manager site that has been compromised to serve Linux malware to users for more than three years. Researchers from Kaspersky discovered a free download manager site that has been compromised to serve Linux malware. org subdomain. org subdomain. ” reported Kasperksy. freedownloadmanager[.]org

Malware

Malware Software Cryptocurrency Passwords

Crooks create rogue cryptocurrency-themed apps to steal crypto assets from users

Security Affairs

JULY 19, 2022

FBI has warned of crooks developing malicious cryptocurrency-themed apps to steal crypto assets from the users. Federal Bureau of Investigation (FBI) has warned of crooks creating malicious cryptocurrency-themed apps to steal crypto assets from investors. Inform customers whether the financial institution has a mobile application.

Cryptocurrency

Cryptocurrency Mobile Hacking Accountability

Highly evasive cryptocurrency miner targets macOS

Security Affairs

FEBRUARY 24, 2023

Trojanized versions of legitimate applications are being used to deploy XMRig cryptocurrency miner on macOS systems. The malicious code uses i2p to download malicious components and send mined currency to the attacker’s wallet. ” reads the analysis published by the experts. ” concludes the report.

Cryptocurrency

Cryptocurrency Malware Software Passwords

Webinars

Reimagining Cybersecurity Training: Driving Real Impact on Security Culture

MORE WEBINARS

Atlassian Confluence bug CVE-2022-26134 exploited in cryptocurrency mining campaign

Security Affairs

SEPTEMBER 22, 2022

The gap is being abused for malicious cryptocurrency mining.” “If left unremedied and successfully exploited, this vulnerability could be used for multiple and more malicious attacks, such as a complete domain takeover of the infrastructure and the deployment information stealers, remote access trojans (RATs), and ransomware.”

Cryptocurrency

Cryptocurrency Firewall Malware Hacking

Enigma info-stealing malware targets the cryptocurrency industry

Security Affairs

FEBRUARY 13, 2023

Alleged Russian threat actors have been targeting cryptocurrency users in Eastern Europe with Enigma info-stealing malware. The attackers are sending out emails with fake job opportunities as bait in an attempt to trick victims into installing Enigma information-stealing malware. ” reads the analysis published by Trend Micro.

Cryptocurrency

Cryptocurrency Malware Media Phishing

New Bandit Stealer targets web browsers and cryptocurrency wallets

Security Affairs

MAY 28, 2023

Bandit Stealer is a new stealthy information stealer malware that targets numerous web browsers and cryptocurrency wallets. Trend Micro researchers discovered a new info-stealing malware, dubbed Bandit Stealer, which is written in the Go language and targets multiple browsers and cryptocurrency wallets.

Cryptocurrency

Cryptocurrency Malware Advertising Phishing

Lazarus APT uses fake cryptocurrency apps to spread AppleJeus Malware

Security Affairs

DECEMBER 4, 2022

The North Korea-linked Lazarus APT spreads fake cryptocurrency apps under the fake brand BloxHolder to install the AppleJeus malware. Volexity researchers warn of a new malware campaign conducted by the North Korea-linked Lazarus APT against cryptocurrency users. In this campaign, the threat actors used the “bloxholder[.]com”

Cryptocurrency

Cryptocurrency Malware Hacking Information Security

Cloud-Based Cryptocurrency mining attacks abuse GitHub Actions and Azure VM

Security Affairs

JULY 12, 2022

Researchers investigated cloud-based cryptocurrency mining attacks targeting GitHub Actions and Azure VMs. Researchers from Trend Micro published a report that details cloud-based cryptocurrency mining attacks targeting GitHub Actions and Azure VMs and the threat actors behind them. ” states the report published by Trend Micro.

Cryptocurrency

Cryptocurrency IoT Software Malware

30 Docker images downloaded 20M times in cryptojacking attacks

Security Affairs

MARCH 30, 2021

Palo Alto Network researcher Aviv Sasson discovered 30 malicious Docker images, which were downloaded 20 million times, that were involved in cryptojacking operations. The expert determined the number of cryptocurrencies that were mined to a mining pool account by inspecting the mining pool. Pierluigi Paganini.

Cryptocurrency

Cryptocurrency Accountability Architecture Software

Supply-chain attack on NPM Package UAParser, which has millions of daily downloads

Security Affairs

OCTOBER 23, 2021

CISA warned of crypto-mining malware hidden in a popular JavaScript NPM library, named UAParser.js, which has millions of weekly downloads. Cybersecurity and Infrastructure Security Agency published an advisory to warn of the discovery of a crypto-mining malware in the popular NPM Package UAParser.js. Pierluigi Paganini.

Malware

Malware Cryptocurrency Accountability Software

JOKERSPY used to target a cryptocurrency exchange in Japan

Security Affairs

JUNE 27, 2023

An unnamed Japanese cryptocurrency exchange was the victim of a cyber attack aimed at deploying an Apple macOS backdoor named JokerSpy. Elastic Security Labs researchers provided details about a recently discovered intrusion at an unnamed cryptocurrency exchange, aimed at deploying an Apple macOS backdoor named JokerSpy.

Cryptocurrency

Cryptocurrency Spyware Malware Architecture

UnityMiner targets unpatched QNAP NAS in cryptocurrency mining campaign

Security Affairs

MARCH 8, 2021

Experts warn of ongoing attacks targeting QNAP network-attached storage (NAS) devices to abuse them in cryptocurrency mining. Researchers at 360Netlab are warning of a cryptocurrency malware campaign targeting unpatched QNAP network-attached storage (NAS) devices. Unity is an XMRig cryptocurrency miner. and Quick.tar.gz.

Cryptocurrency

Cryptocurrency Firmware Malware Threat Detection

Attackers are abusing GitHub infrastructure to mine cryptocurrency

Security Affairs

APRIL 3, 2021

Code repository hosting service GitHub launched an investigation in a series of attacks aimed at abusing its infrastructure to illicitly mine cryptocurrency. Miner itself is downloaded from gitlab. If you want to receive the weekly Security Affairs Newsletter for free subscribe here. Pierluigi Paganini.

Cryptocurrency

Cryptocurrency Accountability Software Engineering

Monero Cryptocurrency campaign exploits ProxyLogon flaws

Security Affairs

APRIL 18, 2021

Threat actors targeted are exploiting the ProxyLogon vulnerabilities in Microsoft Exchange servers to deploy Monero cryptocurrency miners. “The.zip file is not a compressed archive, but a batch script that then invokes the built-into-Windows certutil.exe program to download two additional files, win_s.zip and win_d.zip.”

Cryptocurrency

Cryptocurrency Passwords Hacking Information Security

BunnyLoader, a new Malware-as-a-Service advertised in cybercrime forums

Security Affairs

OCTOBER 3, 2023

The malware also supports anti-sandbox techniques and evasion techniques, it can download and execute a second-stage payload, log keys, steal sensitive information and cryptocurrency, and execute remote commands. ” reads the report published by Zscaler. BunnyLoader v1.7 ” continues the report.

Advertising

Advertising Cybercrime Malware Cryptocurrency

Twitter reveals that hackers also downloaded data from eight compromised accounts

Security Affairs

JULY 19, 2020

The social media giant Twitter confirmed that hackers compromised 130 accounts in last week hack and downloaded data from eight of them. All the accounts were compromised simultaneously and threat actors used them to promote a cryptocurrency scam. ” continues the update. Pierluigi Paganini.

Accountability

Accountability Social Engineering Media Hacking

Clipminer Botnet already allowed operators to make at least $1.7 Million

Security Affairs

JUNE 3, 2022

The bot focuses on cryptocurrency mining and cryptocurrency theft via clipboard hijacking. Clipminer was first spotted in early 2021, it likely spread via Trojanized downloads of cracked or pirated software. Then the downloader connects to the Tor network to download the components of the Clipminer.

Cryptocurrency

Cryptocurrency Malware Hacking Software

Google removed 49 Chrome Extensions that were hijacking cryptocurrency wallets

Security Affairs

APRIL 15, 2020

Google has removed 49 new Chrome browser extensions from its official Web Store that hide the code to hijack cryptocurrency wallets. Google has removed 49 new Chrome browser extensions from its official Web Store that contain the code to steal sensitive information and hijack cryptocurrency wallets. Pierluigi Paganini.

Cryptocurrency

Cryptocurrency Advertising Phishing Passwords

New ElectroRAT employed in a wide-ranging operation targeting cryptocurrency users

Security Affairs

JANUARY 5, 2021

Researchers uncovered a large scale operation targeting cryptocurrency users with a previously undetected multiplatform RAT named ElectroRAT. Security researchers from Intezer uncovered a large scale operation targeting cryptocurrency users with a previously undetected RAT named ElectroRAT. ” continues the variant.

Cryptocurrency

Cryptocurrency Media Advertising Marketing

Attackers target Apache Hadoop and Flink to deliver cryptominers

Security Affairs

JANUARY 15, 2024

Researchers devised a new attack that exploits misconfigurations in Apache Hadoop and Flink to deploy cryptocurrency miners. Cybersecurity researchers from cyber security firm Aqua have uncovered a new attack targeting Apache Hadoop and Flink applications. ” states the report.

Cryptocurrency

Cryptocurrency Big data Software Malware

Lazarus targets blockchain engineers with new KandyKorn macOS Malware

Security Affairs

NOVEMBER 5, 2023

The attackers attempted to trick victims into downloading and decompress a ZIP archive (Cross-Platform Bridges.zip) containing the malicious Python code masqueraded by an arbitrage bot. An arbitrage bot is a tool that allows users to profit from cryptocurrency rate differences between platforms. ” concludes the report.

Engineering

Engineering Malware Cryptocurrency Encryption

Cryptomining campaign targets Linux systems with Go-based CHAOS Malware

Security Affairs

DECEMBER 12, 2022

Researchers spotted a cryptocurrency mining campaign targeting Linux users with Go-based CHAOS malware (Trojan.Linux.CHAOSRAT). In November 2022, Trend Micro researchers discovered a cryptocurrency mining campaign targeting Linux users with Go-based CHAOS malware (Trojan.Linux.CHAOSRAT). Download files. Upload files. Open a URL.

Malware

Malware Cryptocurrency Hacking Software

Threat actors target crypto and NFT communities with Babadeda crypter

Security Affairs

NOVEMBER 26, 2021

Morphisec researchers spread cryptocurrency malware dubbed Babadeda in attacks aimed at crypto and NFT communities. Morphisec researchers spotted a new crypto-malware strain, tracked as Babadeda, targeting cryptocurrency, non-fungible token (NFT), and DeFi passionates through Discord channels. ” concludes the report.

Cryptocurrency

Cryptocurrency Malware Antivirus Phishing

New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader

Security Affairs

JULY 7, 2020

The recent wave has been noted in Portugal and is impacting clients of several Portuguese and Brazilian banking organizations and also some cryptocurrency platforms. Here, it was distributed using fake webpages, where the victim downloaded an MSI file, which then held the remaining Lampion infection chain.

Malware

Malware Banking Phishing Internet

NodeStealer 2.0 takes over Facebook Business accounts and targets crypto wallets

Security Affairs

AUGUST 1, 2023

Researchers spotted a Python variant of the NodeStealer that was designed to take over Facebook business accounts and cryptocurrency wallets. The malicious code was designed to take over Facebook business accounts and steal funds from cryptocurrency wallets. ” reads the analysis published by Palo Alto Networks.

Accountability

Accountability Cryptocurrency Malware Phishing

CVE-2019-11707 Firefox Zero-Day exploited to infect employees at cryptocurrency exchanges

Security Affairs

JUNE 20, 2019

Researchers discovered that recently patched Firefox zero-day (CVE-2019-11707) has been exploited to deliver Windows and Mac malware to cryptocurrency exchanges. According to Martin, other cryptocurrency organizations were hit by similar attacks. browser ) or OS only when the application is downloaded via normal means (i.e.

Cryptocurrency

Cryptocurrency Malware Advertising Passwords

Hackers hijacked the eScan Antivirus update mechanism in malware campaign

Security Affairs

APRIL 24, 2024

A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute backdoors and cryptocurrency miners. The researchers noticed that the downloaded package file is replaced with a malware-laced one on the wire because the process doesn’t use an HTTPS connection.

Antivirus

Antivirus Malware DNS Cryptocurrency

Experts found 3 malicious packages hiding crypto miners in PyPi repository

Security Affairs

JANUARY 4, 2024

Researchers discovered three malicious packages in the PyPI repository targeting Linux systems with a cryptocurrency miner. The malicious packages totaled more than 400 downloads before they were removed from the repository. This file outlines the cryptocurrency mining setting.

Cryptocurrency

Cryptocurrency Accountability Malware Hacking

BlackSquid malware uses multiple exploits to drop cryptocurrency miners

Security Affairs

JUNE 5, 2019

A new piece of malware appeared in the threat landscape, dubbed BlackSquid it targets web servers with several exploits to deliver cryptocurrency miners. Security experts at Trend Micro have discovered a new Monero cryptomining miner, dubbed BlackSquid, that is targeting web servers, network drives, and removable drives.

Cryptocurrency

Cryptocurrency Malware Advertising Hacking

New shc Linux Malware used to deploy CoinMiner

Security Affairs

JANUARY 4, 2023

Researchers discovered a new Linux malware developed with the shell script compiler ( shc ) that was used to deliver a cryptocurrency miner. It downloads and runs files from external sources, and based on the fact that XMRig CoinMiner is downloaded and installed from the currently available address, it is assumed to be a CoinMiner downloader.”

Malware

Malware DDOS Cryptocurrency Firewall

Crooks manipulate GitHub’s search results to distribute malware

Security Affairs

APRIL 13, 2024

The recent malware campaign involves a large, padded executable file that shares similarities with the “Keyzetsu clipper” malware, targeting cryptocurrency wallets. On April 3rd, the attacker updated the code in one of their repositories, linking to a new URL that downloads a different encrypted.7z

Malware

Malware Cryptocurrency Encryption Hacking

3CX Breach Was a Double Supply Chain Compromise

Krebs on Security

APRIL 20, 2023

In late March 2023, 3CX disclosed that its desktop applications for both Windows and macOS were compromised with malicious code that gave attackers the ability to download and run code on all machines where the app was installed. “This could cause the file to run when double-clicked instead of opening it with a PDF viewer.”

Malware

Malware Software Technology Accountability

Threat actors exploit recently disclosed Atlassian Confluence flaw in cryptomining campaign

Security Affairs

JUNE 10, 2022

Threat actors are exploiting the recently disclosed CVE-2022-26134 RCE in Atlassian Confluence servers to deploy cryptocurrency miners. CheckPoint researchers have observed threat actors exploiting the recently disclosed CVE-2022-26134 remote code execution vulnerability in Atlassian Confluence servers to deploy cryptocurrency miners.

Cryptocurrency

Cryptocurrency Malware Hacking Cybersecurity

Info stealer attacks target macOS users

Security Affairs

APRIL 1, 2024

The malicious site includes a link to download Arc for macOS. The disk image file (DMG) downloaded from the site is signed ad-hoc and provides instructions to right-click the app and select open thus overriding any Gatekeeper warnings. This technique allows for evasion of detection.

Malware

Malware Cryptocurrency Software Engineering

Three campaigns delivering multiple malware, including ModernLoader and XMRig miner

Security Affairs

AUGUST 30, 2022

Researchers spotted three campaigns delivering multiple malware, including ModernLoader, RedLine Stealer, and cryptocurrency miners. The downloaded PowerShell code also downloads and runs auxiliary modules and payloads.” “The next stage is the PowerShell loader. ” reads the analysis published by Cisco Talos.

Malware

Malware Cryptocurrency Hacking Technology

Aurora Stealer Malware is becoming a prominent threat in the cybercrime ecosystem

Security Affairs

NOVEMBER 22, 2022

. “These infection chains leveraged phishing pages impersonating download pages of legitimate software, including cryptocurrency wallets or remote access tools, and the 911 method making use of YouTube videos and SEO-poised fake cracked software download websites.” ” reads the analysis by the experts.

Cybercrime

Cybercrime Malware Cryptocurrency Advertising

MrbMiner cryptojacking campaign linked to Iranian software firm

Security Affairs

JANUARY 23, 2021

Once the hackers gained access to a system, they downloaded an initial assm.exe file to achieve persistence and to add a backdoor account for future access. Upon creating the account, the malicious code connects to the C2 to download a Monero (XMR) cryptocurrency miner that runs on the local server.

Software

Software Cryptocurrency Accountability Malware

North Korea-linked Lazarus continues to target job seekers with macOS malware

Security Affairs

SEPTEMBER 28, 2022

North Korea-linked Lazarus APT group is targeting macOS Users searching for jobs in the cryptocurrency industry. Last week, SentinelOne researchers discovered a decoy documents advertising positions for the popular cryptocurrency exchange Crypto.com. This functions as a downloader from a C2 server.

Malware

Malware Cryptocurrency Architecture Advertising

Doki, an undetectable Linux backdoor targets Docker Servers

Security Affairs

JULY 29, 2020

The researchers pointed out that the Doki is a new multi-threaded malware leverages an undocumented technique for C2 communications by abusing the Dogecoin cryptocurrency blockchain in a unique way. The downloader script allows operators to download and install various malware binaries, including cryptominers.

Cryptocurrency

Cryptocurrency Malware Advertising VPN

Crooks impersonate brands using search engine advertisement services

Security Affairs

DECEMBER 26, 2022

. “In instances where a user is searching for a program to download, the fraudulent webpage has a link to download software that is actually malware. The download page looks legitimate and the download itself is named after the program the user intended to download.” Pierluigi Paganini.

Advertising

Advertising Engineering Education Internet

Law enforcement operation dismantled 911 S5 botnet

Security Affairs

MAY 30, 2024

The software may also contain encryption or features subject to export controls under the Export Administration Regulations (EAR), potentially leading to further legal violations by foreign nationals downloading it without a license. ” continues DoJ. Kitts and Nevis, and the United States), and 20 domains. “ The U.S.

VPN

VPN Cryptocurrency Malware Software

Clipper attacks use Trojanized TOR Browser installers

Security Affairs

MARCH 29, 2023

The attackers take advantage of the fact that the official Tor Project has been banned in Russia since the end of 2021, so users in Russia search for third-party repositories to download the Tor browser. The victims download the Tor Browser from a third-party server and execute it as torbrowser.exe. ” concludes the report.

Malware

Malware Passwords Cryptocurrency Antivirus

SmokeLoader campaign distributes new Laplas Clipper malware

Security Affairs

NOVEMBER 8, 2022

Researchers observed a SmokeLoader campaign that is distributing a new clipper malware dubbed Laplas Clipper that targets cryptocurrency users. Clipper is a family of malware designed to hijack cryptocurrency transactions by swapping the victim’s wallet address with the wallet address owned by attackers. ” concludes the report.

Malware

Malware Cryptocurrency Hacking Cybercrime

StripedFly, a complex malware that infected one million devices without being noticed

Security Affairs

OCTOBER 30, 2023

Researchers from Kaspersky discovered a sophisticated malware, dubbed StripedFly, that remained under the radar for five years masquerading as a cryptocurrency miner. Kaspersky discovered that the detections between 2017 and 2022 had previously misclassified as a cryptocurrency miner.

Malware

Malware Cryptocurrency Ransomware Hacking

Free Download Manager backdoored to serve Linux malware for more than 3 years

Crooks create rogue cryptocurrency-themed apps to steal crypto assets from users

Webinars

Trending Sources

Highly evasive cryptocurrency miner targets macOS

Webinars

Atlassian Confluence bug CVE-2022-26134 exploited in cryptocurrency mining campaign

Enigma info-stealing malware targets the cryptocurrency industry

New Bandit Stealer targets web browsers and cryptocurrency wallets

Lazarus APT uses fake cryptocurrency apps to spread AppleJeus Malware

Cloud-Based Cryptocurrency mining attacks abuse GitHub Actions and Azure VM

30 Docker images downloaded 20M times in cryptojacking attacks

Supply-chain attack on NPM Package UAParser, which has millions of daily downloads

JOKERSPY used to target a cryptocurrency exchange in Japan

UnityMiner targets unpatched QNAP NAS in cryptocurrency mining campaign

Attackers are abusing GitHub infrastructure to mine cryptocurrency

Monero Cryptocurrency campaign exploits ProxyLogon flaws

BunnyLoader, a new Malware-as-a-Service advertised in cybercrime forums

Twitter reveals that hackers also downloaded data from eight compromised accounts

Clipminer Botnet already allowed operators to make at least $1.7 Million

Google removed 49 Chrome Extensions that were hijacking cryptocurrency wallets

New ElectroRAT employed in a wide-ranging operation targeting cryptocurrency users

Attackers target Apache Hadoop and Flink to deliver cryptominers

Lazarus targets blockchain engineers with new KandyKorn macOS Malware

Cryptomining campaign targets Linux systems with Go-based CHAOS Malware

Threat actors target crypto and NFT communities with Babadeda crypter

New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader

NodeStealer 2.0 takes over Facebook Business accounts and targets crypto wallets

CVE-2019-11707 Firefox Zero-Day exploited to infect employees at cryptocurrency exchanges

Hackers hijacked the eScan Antivirus update mechanism in malware campaign

Experts found 3 malicious packages hiding crypto miners in PyPi repository

BlackSquid malware uses multiple exploits to drop cryptocurrency miners

New shc Linux Malware used to deploy CoinMiner

Crooks manipulate GitHub’s search results to distribute malware

3CX Breach Was a Double Supply Chain Compromise

Threat actors exploit recently disclosed Atlassian Confluence flaw in cryptomining campaign

Info stealer attacks target macOS users

Three campaigns delivering multiple malware, including ModernLoader and XMRig miner

Aurora Stealer Malware is becoming a prominent threat in the cybercrime ecosystem

MrbMiner cryptojacking campaign linked to Iranian software firm

North Korea-linked Lazarus continues to target job seekers with macOS malware

Doki, an undetectable Linux backdoor targets Docker Servers

Crooks impersonate brands using search engine advertisement services

Law enforcement operation dismantled 911 S5 botnet

Clipper attacks use Trojanized TOR Browser installers

SmokeLoader campaign distributes new Laplas Clipper malware

StripedFly, a complex malware that infected one million devices without being noticed

Stay Connected