- Cyberark finds website promoting pirated software that distributes malware
- One of the malware -variants was a cryptojacker that ran more than 700,000 wallets
- One of the wallets had 600 sun in it
CyberSecurity scientists have recently revealed Massjacker, a new malware variant aimed at stealing cryptocurrency by replacing cryptocurrency addresses in people’s clipboard.
The team from Cyberark said it recently found a site – pesktop[dot]Com that claims to offer all kinds of pirated software, but in reality it distributes different versions of malware, including Massjacker.
It was not said what malware posed like, but when the victims install Massjacker, it works in the background and keeps track of the computer’s clipboard. When a person copies a cryptocurrency address, it will note and replace it with an address belonging to the attacker. That way, when the victim inserts the address, it inserts someone other than the one they copied and it sends money to attackers instead of the one they would send it to.
Hundred thousand of dollars
Cryptocurrency addresses are impossible to remember by the heart as they are a string of 20+ seemingly random characters – which is why most people would keep them stored somewhere and just copy and paste when they would send money. Cyber criminals see this as an opportunity to steal the money, and in terms of Massjacker – it seems to be working.
Cyberark says Massjacker manages more than 770,000 unique crypto addresses. While most of them were empty, 423 had $ 95,300 in them at the time the report was written. “Adding the money previously held in these wallets, but had already been transferred, the total amount brought up to about $ 336,700,” the researchers concluded.
However, that does not mean that all this money came from Massjacker. In fact, Cyberark believes that the opposite can actually be true and that most funds came from “other malicious activities.” That said, cryptocurrency worth about $ 87,000 (600 sun) was found sitting in a single wallet that had 350 transactions.
Via Hacker the news
