Bitcoin Cash

Litecoin

Monero

Dash

Stellar

Styx Stealer, a new malware, stealthily swipes cryptocurrency from Windows-based computers. 
Cybersecurity firm Check Point Research first <a href="https://research.checkpoint.com/2024/unmasking-styx-stealer-how-a-hackers-slip-led-to-an-intelligence-treasure-trove/" target="_blank" rel="">identified</a> Styx as a beefier version of Phemodrone Stealer in April. The malware exploited a now-patched Windows vulnerability, <a href="https://crypto.news/pendle-climbs-14-as-pendle-finance-recovers-from-domain-hijack-attack/" target="_blank" rel="noreferrer noopener">hijacking cryptocurrency</a> transactions and <a href="https://crypto.news/hackers-target-telegram-and-whatsapp-users-with-trojanized-apps-to-steal-crypto/" target="_blank" rel="noreferrer noopener">stealing sensitive data</a> from compromised systems, such as private keys, browser cookies, and even autofill browser data. 
Phemodrone first <a href="https://crypto.news/trend-micro-reveals-new-malware-targeting-crypto-wallets-on-windows/" target="_blank" rel="noreferrer noopener">made waves in early 2024</a>. Unlike Styx Stealer, it focused on web browsers to drain crypto from wallets alongside other information. 
Both malware exploit the same loophole in Windows Defender, the operating system’s native antivirus, taking advantage of an old vulnerability in the antivirus’s SmartScreen feature designed to warn users about potentially harmful websites and downloads. 
However, Styx presents new threats with the addition of the crypto-clipping mechanism. Basically, the malware monitors the clipboard for changes and then replaces copied cryptocurrency wallet addresses with those belonging to the attacker. 
Previously, the Phorpiex botnet was known to use this technique to <a href="https://www.bleepingcomputer.com/news/security/botnet-sent-millions-of-emails-in-lockbit-black-ransomware-campaign/" target="_blank" rel="">hijack</a> crypto transactions.&nbsp; 
According to Check Point Research’s findings, Styx can identify wallet addresses across nine blockchains, including Bitcoin (<a href="https://crypto.news/price/bitcoin/" target="_blank" rel="noreferrer noopener">BTC</a>), Ethereum (<a href="https://crypto.news/price/ethereum/" target="_blank" rel="noreferrer noopener">ETH</a>), Monero (<a href="https://crypto.news/price/monero/" target="_blank" rel="noreferrer noopener">XMR</a>), Ripple (<a href="https://crypto.news/price/xrp/" target="_blank" rel="noreferrer noopener">XRP</a>), Litecoin (<a href="https://crypto.news/price/litecoin/" target="_blank" rel="noreferrer noopener">LTC</a>), Bitcoin Cash (<a href="https://crypto.news/price/bitcoin-cash/" target="_blank" rel="noreferrer noopener">BCH</a>), Stellar (<a href="https://crypto.news/price/stellar/" target="_blank" rel="noreferrer noopener">XLM</a>), Dash (<a href="https://crypto.news/price/dash/" target="_blank" rel="noreferrer noopener">DASH</a>) and Neo (<a href="https://crypto.news/price/neo/" target="_blank" rel="noreferrer noopener">NEO</a>). 
Chromium- and Gecko-based browsers, data from browser extensions, Telegram and Discord are especially vulnerable. 
The malware’s builder has an autorun feature and a user-friendly graphical interface, making it easier for cybercriminals to customize and deploy it. 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcf_qWeEH-vfiYlJ7Vz7hM2bd6Rvx-2aKQdvTovBSWTwdGq9dkwul9vV_Nz59KzndJcUJfnZrSh9HDjlMKlydbrkzrXdKwgCPTsRlignALsRLBO_tL4Mr1IDgWZ7PyNEUN8L0yhrRIZC1_vcYrSdOMmO-aW?key=fr8WmeegdvbAAO1rdbEdOQ" alt="Crypto-clipping malware ‘Styx Stealer’ targets Windows computers - 31">
 <figcaption class="wp-element-caption">
 Styx Stealer user interface | source: <a href="https://research.checkpoint.com/2024/unmasking-styx-stealer-how-a-hackers-slip-led-to-an-intelligence-treasure-trove/?_gl=1*yq497k*_gcl_au*NTI2OTk1OTQxLjE3MjM4MzE3MjQ." target="_blank" rel="">Check Point Research</a>
 </figcaption>
</figure> 
Styx is also equipped with basic anti-analysis techniques to mask its operations. To evade detection, it terminates processes associated with debugging tools and detects virtual machine environments. If such an environment is detected, Styx Stealer initiates self-deletion. 
 You might also like: <a href="https://crypto.news/crypto-malware-angel-drainer-shuts-down-following-developer-identification-report/"> Crypto malware Angel Drainer shuts down following developer identification: report </a> 
<h2 class="wp-block-heading" id="available-via-telegram">Available via Telegram</h2> 
The malware’s distribution and sales are managed manually through the Telegram account @styxencode and the styxcrypter[.]com website. CPR has also discovered advertisements and YouTube videos that promote the malicious software. 
At least 54 individuals had sent the Styx developer approximately $9,500 in payments using various cryptocurrencies like Bitcoin and Litecoin. Unlike its successor, which was free, this malware is available with a monthly license for $75, $230 for three months, and $350 for lifetime access. 
The amount of crypto funds stolen or the scale of the systems infected using Styx remains unclear. 
Crypto-stealing malware has also been <a href="https://crypto.news/kaspersky-warns-of-new-macos-malware-aiming-at-crypto-wallets/" target="_blank" rel="noreferrer noopener">found on Apple’s MacOS</a>, as reported by antivirus developer Kaspersky earlier this year. The malware targeted Bitcoin and Exodus wallets by replacing the actual software with an altered version. 
<a href="https://crypto.news/crypto-hacks-wiped-out-nearly-20b-from-industry-crystal-intelligence-estimates/" target="_blank" rel="noreferrer noopener">Hacks</a> and <a href="https://crypto.news/north-korean-workers-tied-to-1-3m-crypto-theft-zachxbt/" target="_blank" rel="noreferrer noopener">thefts</a> have become <a href="https://crypto.news/illicit-crypto-activity-drops-20-but-stolen-funds-surge-chainalysis-says/" target="_blank" rel="noreferrer noopener">quite profitable</a> as the crypto sector expands, with millions of dollars worth of funds lost yearly. Nevertheless, some infamous threat actors have decided to call it quits. 
Last month, Angel Drainer, a drainer-as-a-service malware responsible for over $25 million in thefts, <a href="https://crypto.news/crypto-malware-angel-drainer-shuts-down-following-developer-identification-report/" target="_blank" rel="noreferrer noopener">shut down operations</a>. In November, multi-chain crypto scam service Inferno Drainer <a href="https://crypto.news/scam-crypto-malware-inferno-drainer-decides-to-move-on-after-stealing-80m/" target="_blank" rel="noreferrer noopener">halted services</a>.&nbsp; 
 Read more: <a href="https://crypto.news/north-korean-hackers-target-crypto-firms-with-durian-malware-kaspersky-confirms/"> North Korean hackers target crypto firms with ‘Durian’ malware, Kaspersky confirms </a>

Crypto-clipping malware ‘Styx Stealer’ targets Windows computers

Table of Contents

crypto.news

Other articles published on Aug 18, 2024

21Shares and VanEck Solana ETF Filings Removed from CBOE Website

VanEck: Bitcoin Miners Could Earn $13.9B Annually from AI Shift

Will Bitcoin Surge Over $60K? Meme Coins on TRON Soar in Popularity: Weekend Watch

Another Glitch Sends XRP Price to 67,720 KRW On Korean Exchange

Ripple CTO highlights AI controversy over dangerous Mushroom identification book

Trump’s Pussy (TRUMPPUS) Memecoin to Skyrocket 18,000% Before Exchange Listings, While Shiba Inu ...

Join our free newsletter for daily crypto updates!