DeFi

Clipper

A malware that infected tens of thousands of devices to mine and steal crypto has ended up bagging only about $6,000.
Cybersecurity firm Doctor Web <a data-ct-non-breakable="null" href="https://news.drweb.com/show/?i=14920&amp;lng=en" rel="null" target="null" text="null" title="null">reported</a> on Oct. 8 that it detected the malware disguising itself as legitimate software, such as office programs, game cheats and online trading bots.
The <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/what-is-cryptojacking-a-beginners-guide-to-crypto-mining-malware" rel="null" target="null" text="null" title="null">cryptojacking</a> and stealing software infected more than 28,000 users, mainly in Russia but also in Belarus, Uzbekistan, Kazakhstan, Ukraine, Kyrgyzstan and Turkey.
The hackers were able to swipe only about $6,000 worth of crypto, according to Doctor Web. Still, it’s unknown how much the malware’s creator may have earned from crypto mining.
The cybersecurity firm said the malware’s sources included fraudulent GitHub pages and YouTube video descriptions with malicious links.
Once a device is infected, stealthily deployed software hijacks computing resources to mine crypto.
A “clipper” also monitors <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/mac-amos-malware-clones-wallet-crypto" rel="null" target="null" text="null" title="null">crypto wallet</a> addresses that users copy onto their device’s clipboard, and the malware replaces them with addresses controlled by the attacker — which is how they swiped crypto.
<figure>
 <img alt="Malware, Scams" src="https://s3.cointelegraph.com/uploads/2024-10/019274e2-05ba-7f6c-8f0e-e8f5be26a57e" title="">
 <figcaption style="text-align: center;">
 Malware attack chain. Source: Doctor Web
 </figcaption>
</figure>
The malware uses sophisticated techniques to avoid detection, including password-protected archives to bypass antivirus scans, disguising malicious files as legitimate system components and using legitimate software to execute malicious scripts.
In September, crypto exchange Binance <a data-ct-non-breakable="null" href="https://www.binance.com/en/blog/security/protect-your-crypto-understanding-the-ongoing-global-malware-attacks-and-what-we-are-doing-to-stop-them-7968393135385409266?ref=blogapp.bitdefender.com" rel="null" target="null" text="null" title="null">warned</a> about clipper malware, noting a spike in activity in late August “leading to significant financial losses for affected users.”
Doctor Web said many of the malware victim’s devices were compromised “by installing pirated versions of popular programs” and recommended only installing software from official sources.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/new-android-malware-steals-private-keys-from-images" rel="null" target="null" text="null" title="null">New Android malware steals private keys from screenshots and images</a>
Clipboard-changing malware has been around for years and was particularly <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/six-tools-used-by-hackers-to-steal-cryptocurrency-how-to-protect-wallets" rel="null" target="null" text="null" title="null">prominent</a> after the 2017 crypto bull market.&nbsp;
These types of malware programs have become more sophisticated, often combining clipboard jacking with other malicious functions.
In September, threat intelligence firm Facct reported that malicious actors and <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/crypto-hacks-and-scams" rel="null" target="null" text="null" title="null">scammers</a> were exploiting <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/email-auto-reply-malware-cryptocurrency-mining" rel="null" target="null" text="null" title="null">email auto-replies</a> to spread crypto mining malware.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/crypto-sec-defi-phishing-malware-hackathon/" rel="null" target="null" text="null" title="null">$55M DeFi Saver phish, copy2pwn hijacks your clipboard: Crypto Sec</a>

Crypto-swiping malware infects 28K users, steals just $6K: Report

Cointelegraph

Other articles published on Oct 10, 2024

Joe Rogan Criticizes Bitcoin & NFTs: Are They Worth the Hype?

Visa Introduces Tokenized Asset Platform for Fiat-Backed Tokens

Gensler Slams Crypto Industry for Proliferating Fraud

New Solana Memecoin Silver Pepe (PEPESILV) to Skyrocket 16,000% Ahead of Exchange Listing

FBI-Linked Wallet Owns Shiba Inu's Bone

Recent Ripple (XRP) Updates, Shiba Inu (SHIB) Price Volatility, and More: Bits Recap Oct 10

Join our free newsletter for daily crypto updates!