- Cyberark finds website promoting pirated software distributing malware
- One of the malware variants was a cryptojacker running more than 700,000 wallets
- One of the wallets had 600 SOL in it
Cybersecurity researchers have recently uncovered MassJacker, a new malware variant aiming to steal cryptocurrency by replacing cryptocurrency addresses in people’s clipboards.
The team from Cyberark said it recently found a website – pesktop[dot]com, which claims to offer all sorts of pirated software, but in reality, it is distributing different versions of malware, including MassJacker.
It wasn’t said what the malware was posing as, but when victims install MassJacker, it works in the background, keeping track of the computer’s clipboard. When a person copies a cryptocurrency address, it will take note, and replace it with an address belonging to the attacker. That way, when the victim pastes the address, it is pasting a different one from the one they copied, and it is sending money to the attackers instead of whoever they wanted to send it to.
Hundreds of thousands of dollars
Cryptocurrency addresses are impossible to memorize by heart, as they are a string of 20+ seemingly random characters – which is why most people would keep them stored somewhere, and just copy and paste whenever they wanted to send funds. Cybercriminals see this as an opportunity to steal the money, and as far as MassJacker is concerned – it seems to be working.
Cyberark says MassJacker manages more than 770,000 unique crypto addresses. While most of them were empty, 423 had $95,300 in them, at the time the report had been written. “Adding the money that was previously held in those wallets but had already been transferred out brought the total up to around $336,700,” the researchers concluded.
However, that doesn’t mean that all of that money came from MassJacker. In fact, Cyberark believes that the opposite might actually be true, and that most funds came from “other malicious activities.” That being said, cryptocurrency worth about $87,000 (600 SOL) was found sitting in a single wallet that had 350 transactions.
Via The Hacker News