2024

Pink

A new Android malware called SpyAgent, discovered by software security firm McAfee, can steal private keys stored in screenshots and images on a smartphone’s internal storage.
More specifically, the malware uses a mechanism known as optical character recognition (OCR) to scan images stored on a smartphone and extract words from them. OCR is present in many technologies, including desktop computers, which can recognize, copy and paste text from images.
McAfee Labs explained that the malware is distributed through malicious links sent through text messages. The cybersecurity company broke down the process, beginning with an unsuspecting user clicking on a link they received.
<figure>
 <img alt="New Android malware steals private keys from screenshots and images" name="" src="https://s3.cointelegraph.com/uploads/2024-09/0191c952-8525-7ff4-98ff-5759218d5d24">
 <figcaption style="text-align: center;">
 Examples of the fraudulent apps discovered by McAfee. Source: McAfee
 </figcaption>
</figure>
The link will redirect the user to a seemingly legitimate website and prompt them to download an application presented as trustworthy. However, the application is the SpyAgent malware, and installing it will compromise the phone.
According to the report, these fraudulent programs are disguised as banking apps, government applications, and streaming services. Upon installing the applications, users are prompted to give the application permission to access contacts, messages and local storage.
<figure>
 <img alt="New Android malware steals private keys from screenshots and images" name="" src="https://s3.cointelegraph.com/uploads/2024-09/0191c954-30a1-79b9-ba63-1dea144605ad">
 <figcaption style="text-align: center;">
 The control panel malicious actors used to manage data stolen from victims. Source: McAfee
 </figcaption>
</figure>
Currently, the malware mainly targets South Korean users and has been detected in over 280 fraudulent apps by McAfee cybersecurity specialists.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/mac-amos-malware-clones-wallet-crypto" rel="null" target="null" text="null" title="null">Mac users beware: AMOS malware clones wallet apps and comes for your crypto</a>
<h2 id="malware-attacks-on-the-rise-in-2024">Malware attacks on the rise in 2024</h2>
Similar malware affecting MacOS systems called “Cthulhu Stealer” was <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/mac-users-warned-over-malware-cthulhusteals-crypto-walletshttps://cointelegraph.com/news/mac-users-warned-over-malware-cthulhusteals-crypto-wallets" rel="" target="_self" text="null" title="https://cointelegraph.com/news/mac-users-warned-over-malware-cthulhusteals-crypto-walletshttps://cointelegraph.com/news/mac-users-warned-over-malware-cthulhusteals-crypto-wallets">identified in August</a>. Like SpyAgent, Cthulhu Stealer disguises itself as a legitimate software application and steals personal information from the user,&nbsp;including MetaMask passwords, IP addresses, and private keys for cold wallets living on the desktop.
During the same month, Microsoft <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/chromium-zero-day-exploited-north-korean-hackers" rel="null" target="null" text="null" title="null">discovered a vulnerability</a> in Google Chrome’s web browser, which was likely exploited by a North Korean hacker group called Citrine Sleet.
The hacker group reportedly created fake cryptocurrency exchanges and used those sites to send fraudulent job applications to unsuspecting users. Any user who followed through with the process inadvertently installed remotely controlled malware on their system—which stole private keys from the user.
Since that time, the Chrome vulnerability has been patched. However, the frequency of the malware attacks prompted the Federal Bureau of Investigation to <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/fbi-warning-north-korea-scheme-steal-cryptocurrency" rel="null" target="null" text="null" title="null">issue a warning</a> about the North Korean hacking group.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/pink-drainer-security-researcher-steals-millions-from-participants/" rel="null" target="null" text="null" title="null">Pink Drainer creator defends his wallet-draining crypto scam kit</a>

New Android malware steals private keys from screenshots and images

Table of Contents

Cointelegraph

Other articles published on Sep 6, 2024

US Fed Governor Christopher Waller Supports Interest Rate Cut Amid Slowing Job Growth

Toncoin (TON) Prediction for September 6

Donald Trump Reaffirms Crypto Leadership Ambition in Economic Speech

Coinbase Stock Plunges as Judge Sides with SEC in Lawsuit

Crypto: The BNB Plunges, But Traders Continue To Bet Big.

Bitcoin Faces Significant Price Drop

Join our free newsletter for daily crypto updates!