Solana

Monero

Read

A set of malicious packages impersonating Kraken, Solana and Monero has flooded NuGet’s server as hackers launch new scams. 
NuGet, a manager used for packaging and distributing software written with the .NET framework, appears to be a target for bad actors seeking to exploit vulnerabilities, impersonating crypto-related packages. 
As first <a href="https://blog.phylum.io/phylum-discovers-seroxen-rat-in-typosquatted-nuget-package/" target="_blank" rel="noreferrer noopener">reported</a> by Phylum researchers, six malicious packages — downloaded by a user named “Disti” — are pretending to be libraries and wrappers for Kraken, Solana, KuCoin and Monero. The bad actor reportedly also tried to bolster credibility by faking the download figures. 
<figure class="wp-block-image size-full">
 <img decoding="async" loading="lazy" width="1000" height="987" src="https://crypto.news/app/uploads/2023/10/yggyihuoiwer4.png" alt="NuGet manager flooded with malicious Kraken, Solana packages - 18" class="wp-image-14203865">
 <figcaption class="wp-element-caption">
 NuGet’s repository of Disti | Source: Phylum
 </figcaption>
</figure> 
Once the malware is installed on a victim’s computer, it executes .cmd and .bat files with the help of two PowerShell scripts. Eventually, the scripts download an external file, trying to stay unnoticed by not producing visible output or errors. 
After a long series of manipulations, the script downloads SeroXen RAT. This stealthy remote access trojan gained popularity when it was used alongside cheats for video games such as Call of Duty: Warzone and Fortnite. The trojan is well-known among cybercriminals as it gives them full access to a victim’s computer with low detection. As noted by BleepingComputer, the malware is still available on NuGet’s server. 
 You might also like: <a href="https://crypto.news/group-ib-warns-about-malware-targeting-banking-apps-and-crypto-wallets-in-vietnam/"> Group-IB warns about malware targeting banking apps and crypto wallets in Vietnam </a> 
As crypto.news earlier <a href="https://crypto.news/new-windows-php-malware-targets-facebook-accounts-and-cryptocurrency-wallets/" target="_blank" rel="noreferrer noopener">reported</a>, a new iteration of the Ducktail phishing campaign also spreads PHP malware that can access and steal users’ Facebook accounts, browsing data, and even crypto wallets. The attackers are said to employ social engineering techniques and seek targets through LinkedIn, a professional networking website. 
The malware is being distributed as an archive, including images, videos, and documents. Once the file has been downloaded and opened, browser cookies are read and transmitted to the hacker’s server. 
 Read more: <a href="https://crypto.news/blackberry-identifies-malware-that-affects-crypto-community/"> Blackberry identifies malware that affects crypto community </a>

NuGet manager flooded with malicious Kraken, Solana packages

crypto.news

Other articles published on Oct 13, 2023

Is It Too Late to Buy THORChain? RUNE Price Spikes Up 12% as Telegram Crypto Casino Project Appro...

Tattoos as NFTs: Machine Paves Way for Artist Royalties – Here's How it Works

Talos integrates non-US Coinbase operation for perpetual futures trading

2023’s Top Crypto Choices for Retail Investors: Polygon, VC Spectra, and Filecoin

Loom Network (LOOM) Shines Bright With 510% Surge in a Month

Positioning for Success in 2023: Chiliz (CHZ), ApeCoin (APE), and Tradecurve Markets (TCRV)

Join our free newsletter for daily crypto updates!