Uniswap

Apple

Security

Discord

The crypto space is currently a target for malicious intent as a new wave of cyber attacks has been noted, one being the Apple MacOS malware. As a social engineering attack strategy, the crypto community members have been the major victims since the malware is embedded in a zip file, imitating a bot designed to assist in automated trading and generating profits.&nbsp;
It’s still evident that malicious attacks in the digital space are inevitable, and as such, exercising a degree of keenest in digital transactions is key to mitigating these challenges. The recent malware attack on the Apple MacOS is proof of a primary challenge that faces the world of crypto directly.&nbsp;
<h2 class="wp-block-heading" id="the-apple-macos-malware">The Apple MacOS malware</h2>
The Apple MacOS has been a gateway used by hackers in attaching the <a href="https://www.cryptopolitan.com/whatsapp-phishing-scams-trouble-singapore/" rel="noopener noreferrer nofollow">crypto </a>community. The designed malware is, in fact, a malicious ZIP archive tagged “Cross-platform Bridge.zip,” and it reflects an automated crypto bot used to trade digital assets.&nbsp;
The culprits of this new malware are linked to the Lazarus group, a notorious team of hackers from North Korea. Digging deeper into the matter, Elastic Security Labs informed on the detailed features the malware is capable of.&nbsp;
According to the expert analysis firm, the MacOS malware is a hidden backdoor that’s capable of several features, including data retrieval, secure deletion, directory listing, process termination, file upload and download, as well as command execution.&nbsp;
Discord was the initial channel used in spreading Python-based modules of the ZIP file as the exploiters impersonated community members. They tricked the <a href="https://www.cryptopolitan.com/safemoon-addresses-recent-exploits-and-sec/" rel="noopener noreferrer nofollow">crypto </a>community into downloading the malicious ZIP archive.&nbsp;
Moreover, the malware imports 13 malicious modules that blend together in combined efforts of stealing information and manipulating services. The Apple team commented in a report pertaining to the recent hacking discovery:
<blockquote class="wp-block-quote">
 &nbsp;We observed the threat actor adopting a technique we have not previously seen them use to achieve persistence on macOS, known as execution flow hacking. <cite>Apple</cite>
</blockquote>
&nbsp;As a major target for the Lazurus group, the crypto community should be cautious in downloading or installing applications linked to their trading portfolios. The group is focused on financial gain, among other operations, and the existence of KandyKorn proves that macOS is also another target well within the group’s range.&nbsp;
Lazarus threatens the crypto space through its remarkable skills of creating highly sophisticated malware that is also inconspicuous, specifically tailored for Apple computers and cryptocurrency traders.&nbsp;
<h2 class="wp-block-heading" id="malware-exploitation-in-the-crypto-space">Malware exploitation in the crypto space</h2>
Another similar incident that occurred recently was the Unibot exploit. The famous Telegram bot was used to enter sniper trades on the Uniswap decentralized exchange. This was followed by a 40% crash in the token’s market price in under an hour.&nbsp;
The Unibot exploiters transferred memecoins from Unibot users and exchanged them for Ethereum (ETH). According to <a href="https://x.com/0xScopescan/status/1719222329224704307?s=20" rel="noopener noreferrer nofollow" target="_blank">Scopescan</a>, a popular crypto analysis firm, the exploit size totaled $560K.&nbsp;
The blockchain analysis firm also involved the Unibot users in the happenings of the attack in real-time, which was later confirmed through official sources. Unibot addressed this issue and commented on offering compensation for all affected users who had lost their funds because of the recent contract exploit. Unibot was quoted on X stating:
<blockquote class="wp-block-quote">
 &nbsp;We experienced a token approval exploit from our new router and have paused our router to contain the issue. <cite>Unibot</cite>
</blockquote>
Elastic Security Labs also added to a disclosing novel that seeks to victimize the blockchain developers of cryptocurrency exchange platforms.&nbsp; The intrusion leveraged a pile of open-source and custom capabilities that granted post-exploitation and initial access. The security lab <a href="https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn" rel="noopener noreferrer nofollow" target="_blank">stated</a>:
<blockquote class="wp-block-quote">
 &nbsp;We discovered this intrusion when analyzing attempts to load a binary into memory on a macOS endpoint reflectively. The intrusion was traced to a Python application posing as a cryptocurrency arbitrage bot delivered via a direct message on a public Discord server. <cite>Elastic Security Labs</cite>
</blockquote>

A surge of MacOS malware aimed at the crypto industry worries Mac users

Table of Contents

Cryptopolitan_News

Other articles published on Nov 3, 2023

42,000 Bitcoin and 220,000 Ethereum Options Expire Today! What Does It Mean for BTC and ETH?

A Look at Sam Bankman-Fried’s Possible Life Sentence Through the Lens of Federal Guidelines

Now what happens to Caroline Ellison, Gary Wang, and Nishad Singh?

How Banking Giant HSBC Is Using Blockchain Platform To Change The Gold Trading Game

Meme-Based AI Personal Assistant Has Arrived - Aimeme.ai (AIM) (3 Nov)

Shiba Inu $1 Forecast: Evaluating the Chances of SHIB’s Remarkable Rise

Join our free newsletter for daily crypto updates!