Hackers are using fake apps and wallets to steal your crypto
Popular crypto apps are getting cloned as Web3 users targeted
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cryptocurrency users and enthusiasts are being targeted by malicious actors with fake wallet apps that steal their precious tokens, researchers have found.
Cybersecurity researchers from Confiant discovered that some of the world’s most popular cryptocurrency wallets are being spoofed byclonesthat carrymalware.
Coinbase, MetaMask, TokenPocket, and imToken products are among those affected, with the threat actors hainge created apps seemingly identical to the legitimate ones, but with one key difference - they carry a backdoor that’s capable of stealing people’s security phrases. The security phrase, or secret key, is a string of words used to recover, or load, an existing wallet into the new app.
Share your thoughts on Cybersecurity and get a free copy of the Hacker’s Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at theend of this surveyto get the bookazine, worth $10.99/£10.99.
Tens of millions of potential targets
People use it when they forget their passwords, install the app on a new endpoint, or otherwise need to load a wallet on a different device.
Being malicious, these apps cannot be found on official app repositories, such as thePlay Storeor App Store. Instead, the threat actors rely on distributing the app via web pages, which they promote through blackSEOtechniques, SEO poisoning, social media marketing, forum promotions, malvertising, etc.
The researchers could not say how many people were tricked into downloading these apps, but Coinbase’s app alone has more than 10 million downloads, just on Android.
Popular crypto wallet discontinued after fatal flaw discovered>Scammers are using a whole load of tricks to launch cryptomining scams>Dangerous phishing pop-ups appear across major crypto websites
As for the victims, the attackers seem to be mostly targeting the Asian population. Search results from the Baidu engine have been most impacted by the campaign, as these have been directing “massive amounts” oftrafficto the sites that host the malicious apps.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The attackers themselves seem to be Asian, as well. Confiant calls them SeaFlower, and believes them to be Chinese due to subtle hints like the language of the comments in the source code, the location of the infrastructure, and the frameworks and services used.
The campaign seems to have been active since at least March this year, Confiant says, adding that it’s “the most technically sophisticated threat targeting web3 users, right after the infamous Lazarus Group.”
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
7 myths about email security everyone should stop believing
Best Usenet client of 2024
Anker Nebula Mars 3 review: A powerful and truly portable projector
