{"id":12110,"date":"2022-11-28T21:06:00","date_gmt":"2022-11-28T18:06:00","guid":{"rendered":"https:\/\/alfacash.blog\/?p=12110"},"modified":"2024-02-19T21:50:07","modified_gmt":"2024-02-19T18:50:07","slug":"malicious-silent-browser-extension-stealing-cryptocurrency","status":"publish","type":"post","link":"https:\/\/alfacash.blog\/el\/2022\/11\/28\/malicious-silent-browser-extension-stealing-cryptocurrency\/","title":{"rendered":"New malicious browser extension is stealing cryptocurrency"},"content":{"rendered":"

Once again, hackers are improving their abilities to empty digital wallets. This time, they built a malicious extension for Chromium-based browsers (such as Google Chrome, Opera, Brave, Yandex, and Microsoft Edge). Silently operating in the background, this stealing malware can directly take cryptocurrency from wallets <\/strong>and also the passwords of popular crypto exchanges.<\/p>\n\n\n\n

Dubbed \u201cVenomSoftX\u201d by the cybersecurity brand Avast, the extension is derived from the information stealer ViperSoftX \u2014around since 2020. VenomSoftX has new and combined capabilities, though. It can act as a Remote Access Trojan (RAT), while also having clipper and API tampering features. As they explained<\/a>:<\/p>\n\n\n\n

\u201cThe malicious extension provides full access to every page the victim visits, carries out man-in-the-browser attacks to perform cryptocurrency addresses swapping by tampering with API requests\u2019 data on popular cryptocurrency exchanges, steals credentials and clipboard content, tampers with crypto addresses on visited websites, reports events using MQTT to the C&C server, and more.\u201d<\/p><\/blockquote>\n\n\n\n

This way, when the victim visits custodial crypto exchanges like \u039a\u03ac\u03b8\u03b9\u03c3\u03bc\u03b1<\/a>, Coinbase, Gate.io, or KuCoin, not only their credentials can be snatched away. By tampering with APIs and kidnapping the clipboard (like malware clippers<\/a> do), the extension is capable to change legit cryptocurrency addresses for others owned by the hackers.<\/strong><\/p>\n\n\n\n

\"Malicious-extension-cryptocurrency-stealing\"
The extension disguises itself as “Google Sheets 2.1”. Image by Avast<\/figcaption><\/figure><\/div>\n\n\n\n

So, instead of copying\/pasting the intended address to send funds, the victim may end up using the hacker’s address \u2014allowing the cryptocurrency stealing. The worst part is this could be noticed only when it\u2019s too late, in the transaction history. That\u2019s why prevention is the best path to follow.<\/p>\n\n\n\n

VenomSoftX is being distributed through non-official copies of software like Adobe Illustrator, Corel Video Studio, Microsoft Office, games<\/a>, and more. Usually, numerous torrents come infected with it. The victim gets what they wanted, but also the malware.<\/p>\n\n\n\n

How to avoid cryptocurrency stealing<\/strong><\/h2>\n\n\n\n

The crypto-stealing malware comes in numerous presentations<\/a> and campaigns worldwide. It can affect anyone, thus, it\u2019s important to take some preventive measures. For clippers, it\u2019s always necessary to check twice the pasted crypto addresses.<\/strong> But there are more things we can do to avoid all kinds of malware.<\/p>\n\n\n\n

\"exploit-bug-crypto-defi\"<\/figure><\/div>\n\n\n\n