Cryptocurrency

Litecoin

Monero

April

Pink

New malware called Styx Stealer has been uncovered by cybersecurity solutions provider Check Point Research. The newly discovered malware can steal a vast array of material, including cryptocurrency, through a mechanism known as clipping. It is freely available on a rental basis on the developer’s website.
Windows users with an up-to-date operating system are safe from the malware, since Styx Stealer depends on a vulnerability in Microsoft Windows Defender that was patched last year.
<h2 id="malware-upgraded-to-steal-crypto">Malware upgraded to steal crypto</h2>
Styx Stealer was <a href="https://blog.checkpoint.com/research/unmasking-styx-stealer-how-a-hackers-slip-led-to-an-intelligence-treasure-trove-and-their-big-reveal/" target="_blank" rel="noopener nofollow">discovered</a> because the developer experienced a data leak during debugging. It is derived from an older malware called Phemedrone Stealer. It maintains the functions of Phemedrone Stealer, such as stealing saved passwords, cookies, auto-fill data, cryptocurrency wallet data and instant messenger sessions, while incorporating new detection evasion techniques and adding a crypto clipper function.
Cryptocurrency clipping occurs when malware substitutes a crypto recipient’s wallet address with the bad actor’s wallet during a transaction. 
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-08/6cbc471f-d336-4fea-8cb2-b36f49b0c998.png" alt="Styx Stealer malware exploits Windows vulnerability to ‘clip’ crypto" title="">
 <figcaption style="text-align: center;">
 Styx Stealer crypto clipper user interface. Source: <a href="https://research.checkpoint.com/2024/unmasking-styx-stealer-how-a-hackers-slip-led-to-an-intelligence-treasure-trove/?_gl=1*yq497k*_gcl_au*NTI2OTk1OTQxLjE3MjM4MzE3MjQ." target="_blank" rel="noopener nofollow">Check Point Research</a>
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/fake-zoom-malware-steals-crypto-while-stuck-loading-user-warns">Fake Zoom malware steals crypto while it’s ‘stuck’ loading, user warns</a>
Styx Stealer was launched in April and can be licensed for $75 per month or $350 for a lifetime license. The pricing and features were displayed on the website styxcrypter.com until midday on Aug. 16, when they were replaced with information about another product. Purchases could be <a href="https://research.checkpoint.com/2024/unmasking-styx-stealer-how-a-hackers-slip-led-to-an-intelligence-treasure-trove/?_gl=1*yq497k*_gcl_au*NTI2OTk1OTQxLjE3MjM4MzE3MjQ." target="_blank" rel="noopener nofollow">made</a> via Telegram using Bitcoin (<a href="https://cointelegraph.com/bitcoin-price">BTC</a>), Litecoin (<a href="https://cointelegraph.com/ltc-price-index">LTC</a>), Tron (<a href="https://cointelegraph.com/tron-price-index">TRX</a>), Tether (<a href="https://cointelegraph.com/tether-price-index">USDT</a>), or Monero (<a href="https://cointelegraph.com/xmr-price-index">XMR</a>). Explanatory videos were also available on YouTube at one time.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-08/5f7929a7-4e46-4612-8ae3-a54a8088efee.png" alt="Styx Stealer malware exploits Windows vulnerability to ‘clip’ crypto" title="">
 <figcaption style="text-align: center;">
 Styx Stealer prices and features. Source: <a href="https://research.checkpoint.com/2024/unmasking-styx-stealer-how-a-hackers-slip-led-to-an-intelligence-treasure-trove/?_gl=1*yq497k*_gcl_au*NTI2OTk1OTQxLjE3MjM4MzE3MjQ." target="_blank" rel="noopener nofollow">Check Point Research</a>
 </figcaption>
</figure>
<h3 id="hacking-is-paying-well-in-2024">Hacking is paying well in 2024</h3>
Point Research identified eight wallets presumably belonging to the Turkey-based Styx Stealer developer that had received around $9,500 in crypto as payment for the malware in the first two months of its operation.
<figure>
 <img src="https://s3.cointelegraph.com/uploads/2024-08/5b6e50ce-6950-447c-aa89-53f542d8ca66.png" alt="Styx Stealer malware exploits Windows vulnerability to ‘clip’ crypto" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/_CPResearch_/status/1824478552571416884" target="_blank" rel="noopener nofollow">Check Point Research</a>
 </figcaption>
</figure>
Check Point Research also obtained the developer’s Telegram accounts, email addresses, phone numbers and contacts.
According to a report released by Chainalysis on Aug. 15, legitimate cryptocurrency activity is growing faster than illicit activity, although the value of the crypto hacked has increased. That is at least in part due to the price recovery of Bitcoin. The number of hacking incidents in 2024 has increased only marginally year-on-year.
Magazine: <a href="https://cointelegraph.com/magazine/pink-drainer-security-researcher-steals-millions-from-participants/">Pink Drainer creator defends his wallet draining crypto scam kit</a>

Styx Stealer malware exploits Windows vulnerability to ‘clip’ crypto

Table of Contents

Cointelegraph

Other articles published on Aug 16, 2024

NCSoft Reaps 250x Profit Surge from SUI Tokens Investment!

Trump’s Pussy (TRUMPPUS) to Explode Over 19,000% Before Exchange Listings, While Shiba Inu and Do...

ViaBTC Becomes Leading Litecoin Mining Pool

7 Major Altcoin Developments Today: Pay Attention to These Game-Changing Moves

South Korea’s NPS Buys 245K MSTR Stocks In Q2; SEC Approves MSTX!

BlackRock Is Now The Largest Crypto ETF Issuer, Outshining Grayscale

Join our free newsletter for daily crypto updates!