{"id":12213,"date":"2022-12-05T22:17:00","date_gmt":"2022-12-05T19:17:00","guid":{"rendered":"https:\/\/alfacash.blog\/?p=12213"},"modified":"2024-02-19T21:50:06","modified_gmt":"2024-02-19T18:50:06","slug":"fake-trading-apps-coming-crypto-stealing-malware","status":"publish","type":"post","link":"https:\/\/alfacash.blog\/nb\/2022\/12\/05\/fake-trading-apps-coming-crypto-stealing-malware\/","title":{"rendered":"Fake trading apps are coming with crypto-stealing malware"},"content":{"rendered":"

On the Internet, not everything is what it seems to be. Hackers and scammers worldwide not only can pretend to be someone else but also copy legit software to inject it with malicious features. That\u2019s the case (again) with several trading apps for cryptocurrencies. They might be infected with the crypto-stealing malware dubbed \u2018AppleJeus\u2019.<\/strong><\/p>\n\n\n\n

The cybersecurity firm Volexity<\/a> has been studying a new campaign of that malware since June 2022. Those responsible for this virus would be the North Korean hackers known as Lazarus Group. Their goal is likely monetary benefits from unwilling victims<\/a> worldwide. But they also gather all the information they can from devices \u2014perhaps to prepare for further attacks.<\/p>\n\n\n\n

For this campaign, they registered the website domain \u201cBloxHolder\u201d<\/strong> and pretended to offer automatic trading with cryptocurrencies. However, the entire site and its app are only clones<\/a> of the legitimate services offered by HaasOnline. Once the trader falls into the trap and installs the app, the crypto-stealing malware is also installed on the device and starts looking for wallets to empty.<\/p>\n\n\n\n

\"Apps-crypto-stealing-malware\"
The legit site (left) and the fake site (right). Image by Volexity<\/figcaption><\/figure><\/div>\n\n\n\n

Since October 2022, it was discovered that the hackers also distributed infected Microsoft Office documents \u2014probably through mail and Telegram. These come with the AppleJeus ready to escape into the host system and look for kryptovalutaer<\/a> to steal. One of the malicious documents was named \u201cOKX Binance & Huobi VIP fee comparision (sic)\u201d, which implies that they\u2019re especially targeted at crypto users.<\/p>\n\n\n\n

\u201cBloxHolder\u201d isn\u2019t the only malicious brand, either. This malware has been registered since 2018 and has used a whole list of fake services and names to attract new victims<\/strong>. Among the names<\/a> they\u2019ve adopted are Ants2Whale, Celas Trade Pro, JMT Trading, Union Crypto, Kupay Wallet, CoinGoTrade, and Dorusio.<\/p>\n\n\n\n

How to avoid crypto-stealing malware<\/strong><\/h2>\n\n\n\n

As we may guess, it\u2019s quite important to check for previous reviews before using any platform. Especially, any platform that involves money, and any crypto-related platform. Other security measures<\/a> for users are basic: download software only from official and reputed sites, keep on and update their antivirus, prepare backups, and pay attention to potentially fake services.<\/p>\n\n\n\n

\"Svindlere-OpenSea-NFT-Discord\"<\/figure><\/div>\n\n\n\n

Protection could be more complicated for organizations since they need to teach their employees about cybersecurity. Nevertheless, the Singapore Computer Emergency Response Team (SingCERT<\/a>) has offered some institutional advice about this crypto-stealing malware beyond the basics<\/strong>:<\/p>\n\n\n\n