Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Crypto Wallet. Show all posts
Ethereum platform
Crypto Wallet cryptocurrency Cyber Security Cybersecurity Infrastructure Ethereum Ethereum platform

MetaMask Takes Precautionary Action After Infrastructure Security Incident

 

Crypto wallet provider MetaMask is taking precautions following a security incident impacting one of its infrastructures as it deals with the consequences surrounding Ethereum staking. The company has remained silent on the details concerning the systems that were compromised or whether information or infrastructure was at risk as the breach occurred. A spokesperson for MetaMask directed queries towards the company’s public statement on the issue. 

The company announced that it is addressing the matter internally with the help of external partners and security advisers while noting that there are no immediate risks to MetaMask wallets. The response to the incident involved changes to the non-custodial staking operations at MetaMask as the firm continues to remove the affected validators in collaboration with partners and clients while mitigating any further risks that may arise. 

The company is quick to note that its staking service is non-custodial meaning that it does not possess the withdrawal keys to the stakes deposited by clients. This is an important observation as the response to the security incident only involves the staking infrastructure and not the management of the deposits by clients. Part of the precautions being taken are affecting the validators through the Lido protocol as the firm announced that MetaMask Staking, previously known as Consensys Staking, had initiated protective measures for the clients’ assets on the Ethereum blockchain. 

The procedure involved transitioning the Ethereum validators operated by Lido Finance to the exit process. The changes to the validators through the Lido protocol will cause disruptions to the staking processes and may result in economic losses to the clients who have chosen to use the staking services. This occurs as the validators are being exited to mitigate the risks posed by the security incident affecting the Ethereum network. The Lido protocol further noted that the affected validators had begun exiting the protocol while also stating that the last validator would exit by October 7th. 

However, the date does not signify the day when the validators will have exited completely as some of them might be offline as of the 7th . Validators are critical to the operations of the Ethereum network as they propose new blocks, verify transactions and secure the network through their specialized software. As such, it will require significant efforts to ensure the adjustments made to the validators do not cause disruptions to staking processes while eliminating risks to the stakeholders who utilize the MetaMask services. 

MetaMask has not released further details concerning the security incident and its impact on the infrastructures that support its operations. For now, the company is focusing on addressing the effects of the incident while collaborating with external security advisers and partners. MetaMask is a crypto wallet provider whose products are developed by blockchain software company Consensys. It offers non-custodial crypto wallet solutions for individuals and organizations while allowing them to store their digital assets on the Ethereum network and other compatible blockchains.
Read more »
Trezor
Crypto Crypto Wallet Data Breach Data Leak data security Trezor

Trezor Data Breach Rises to 67,000 US Customers


Hardware cryptocurrency wallet organization Trezor has disclosed that additional 67,000 customers in the US have been impacted by a data breach consisting of its shipping provider, ShipMonk. 

The recent news has notably increased the number of consumers potentially exposed in the incident.  “We're deeply saddened to share the news that the recent data breach affects more customers than originally thought,” Trezor said on X. 

As per Trezor, the additional 67000 customers placed orders from November 2019 to August 2021. 

What is leaked?

The leaked data consists of customers' email, phone numbers, names, addresses, order numbers, and shipping addresses. According to Trezor, the data was stored by ShipMonk even though Trezor had earlier received assurance that previous consumer data had been erased. 

“Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications. We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems,” Trezor said.

According to experts, the breach is not impacting Trezor’s own systems. 

Who are impacted?

Trezor said its hardware wallets are safe and there are no signs that customers’ recovery seed phrases or private keys were breached in the leak. 

As per Trezor, “All affected customers have been emailed directly. If you didn’t receive an email, then you are not affected.”

Potential impact

But Trezor and cybersecurity experts are worried that the stolen data could be exploited for social engineering and targeted phishing attacks. Threat actors could misuse customers’ details regarding their Trezor purchases to create scam phone calls or fraud messages.

This can be a serious problem for cryptocurrency users. A threat actor could mimic a company employee if they know someone owns a Trezor wallet and ask the target to verify their wallet or account. 

User advisory

If successful, the attacker could steal the target’s recovery seed phrase, which can allow access to cryptocurrency funds. “Trezor systems were not compromised, and your device is secure. But please be alert for fake emails, phone calls, fraudulent letters, and potential risks to physical security,” the company added. 

The announcement comes after the August incident when 13,689 customers had been impacted by the same shipping-provider. At the time, Trezor estimated around 14,000 customers to have been affected by the breach. The recent disclosure of 67,000 suggests the scope of the incident was larger than expected.

Read more »
Supply Chain
Bitcoin Crypto Wallet Cyber Security Ethereum Supply Chain

Hackers Compromise Organization to Swap Crypto Wallet Address In A Supply Chain Attack


Threat actors exploited a JavaScript file offered by advertising technology firm Adform, and modified it into a browser-side tool that rewrites crypto wallet addresses.

Malicious script

Adform found the incident and removed the malicious code, informed the impacted clients, and notified the authorities.

For users who visited a website carrying the modified script on July 27 and copied Ethereum, Tron, or Bitcoin may have deployed malicious code by pasting the a different address.

What should the users do?

Adform has advised users to clean their browser cache as the modified file may stay cached after the fix, and to also double-check any wallet address before sending any money.

According to Adform, the code was not built to deploy software or create persistence and worked only when an affected page stayed open. Clipboard copying was not the only method of replacement; the captured sample also rewrites addresses entered straight into form fields. 

According to Adform’s implementation document, the tracking code can run across a website, several sections, or even a single page. Exploiting the shared resource allowed the hackers a path into downstream websites without having to hack each one of them. Supply chain compromise happened due to the shared deployment path. 

Shared path leading to supply chain attack

One modified address at the point of payment could change a transfer, as the impacted page stayed open.

Security expert Beaumont discovered the hack and said, "Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.”

Beaumont also said that “this allows end user devices of downstream websites to be compromised with crypto stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device.” The file and linked domains, IP addresses, and URLs showed no detections on VirusTotal at the time. 

The discovered sample consists of two malicious blocks attached to the authentic library. Their replacement strings are hidden with a six-byte XOR key. The first looks out for the copy event, attempts to read the clipboard every four seconds, and to replace matching addresses.

The second block rewrites values in textarea, contenteditable elements, and input, and restores the cursor point after a rewrite.

“Based on our investigation to date, we have found no evidence that the malicious code transmitted users’ IP addresses or information about the websites they visited to an external party. Technical analysis indicates that such transmission may have been possible, and this aspect remains under investigation,” says Adform.

Read more »
Malicious Software
Crypto Wallet cyber attack Cyber Security GitHub malicious npm package Malicious Software

Injective Labs GitHub Compromise Distributes Malicious npm Package Targeting Crypto Wallet Keys

 

Cybersecurity researchers have detected a software supply chain attack in which threat actors compromised the Injective Labs SDK GitHub repository and utilized it to distribute a backdoored version of the npm package containing cryptocurrency wallet credentials stealing capabilities. Researchers at security company Socket have identified that the attackers distributed the malicious code in the @injectivelabs/sdk-ts version 1.20.21 after compromising the GitHub account of one of the trusted maintainers. 

The compromised package was published to the npm registry on July 8, 2026, and subsequently deprecated. Nevertheless, the distribution channel for the malicious artifacts remained available on GitHub at the time of publication. The attackers distributed the backdoored SDK to 17 other @injectivelabs packages, including the wallet, utility, networking, and crypto modules. Since the packages include various apps as dependencies, developers who did not directly install the SDK might also be affected. 

Unlike traditional supply chain malware that typically persists in the compromised software at installation time, the detected backdoor was not activated when the developers installed the package. Rather, the malicious code was designed to exfiltrate the cryptographic assets when the developers used the SDK’s wallet generation feature. 

Thus, the threat actors could hide the malicious payload’s presence by avoiding the use of suspicious scripts typically associated with malware. The detected malware consisted of modified cryptographic functions that replaced the legitimate implementation with the backdoor, which the attackers masked as a performance telemetry component. The additional function exfiltrated the cryptographic assets, including the mnemonic seed phrase and private key generation details, required to recreate the cryptocurrency wallet. 

Researchers noted that the malware persisted in the compromised repositories by sending the collected data to the remote server in aggregated fashion to avoid suspicion by grouping multiple exfiltration requests into one encrypted HTTPS session. The security analysts at OX Security stated that the detected threat was capable of intercepting the master recovery phrase used to seed cryptocurrency wallets. Since the mnemonic seed phrase gives the adversary full access to the wallet funds, threat actors could reproduce the cryptographic assets to gain unauthorized access to the blockchain assets. 

The malware’s distribution channel was compromised using the trusted publishing infrastructure and OpenID Connect (OIDC) publishing pipeline. The detected threat utilized the legitimate account of one of the maintainers, which implies that the attackers did not have to use supply chain malware or impersonate the project on a third-party registry. The developers who installed the affected package should switch to the latest version, 1.20.23, which has been released. 

The security analysts advise the developers to consider all private keys and mnemonic phrases generated with the compromised version of the code as compromised and take the appropriate actions to rotate the cryptographic assets. Moreover, the developers should review their project dependencies to ensure that they do not use the affected versions of the packages indirectly. 

The incident demonstrated how the threat actors could target the software supply chain to compromise the cryptocurrency ecosystem and gain unauthorized access to the crypto assets by compromising the open-source developer infrastructure.
Read more »
Siri Vulnerability
Apple Security Bluetooth Forensics Crypto Wallet cryptocurrency theft Cybercrime Investigation digital surveillance FakeWallet Campaign iOS security malware Siri Vulnerability

Apple Account Data and Bluetooth Signals Tie Suspect to Crypto Robbery


 

The App Store ecosystem has been infiltrated by a coordinated wave of fraudulent cryptocurrency wallet applications that exploit regional platform restrictions and user trust to steal credentials from iOS users. More than two dozen malicious apps have been identified as related to a campaign called "FakeWallet," which has been active since at least late 2025 and was designed to harvest passwords and private keys from unsuspecting users via the use of various malware programs.

During the early months of March, counterfeit wallet applications became prominent in search results within China’s App Store after they began appearing prominently in search results, posing a threat to the legitimacy of several legitimate crypto wallet services due to regulatory restrictions. 

In addition to replicating the trusted wallet branding, abusing typosquatting techniques and embedding deceptive prompts leading users towards unofficial wallet downloads, the campaign blurred the distinction between genuine financial tools and malicious software, significantly increasing iPhone users' chances of committing cryptocurrency theft. 

During technical analysis, Kaspersky determined that phishing applications were primarily used as delivery mechanisms for trojanized cryptocurrency wallet software to be installed via browsers. According to the researchers, malicious payloads are commonly embedded through third-party libraries embedded within the applications, despite several samples demonstrating direct modifications of the wallet code itself, indicating a more sophisticated level of tampering. 

Through reverse engineering, special routines have been found that can intercept and exfiltrate recovery phrases as well as seed phrases, while simultaneously manipulating the wallet restoration process for recovering hot wallets. The investigation also identified two separate implants targeting cold wallets hosted on Ledger, extending the campaign's scope beyond software-based assets to hardware wallet users as well. 

A counterfeit website impersonating Ledger's official platform was also discovered by researchers, which distributed malicious iOS application links and compromised Android wallet packages hosted on Chinese-language phishing websites outside of Google Play. It is unclear whether the malware modules had geographic enforcement mechanisms despite the infrastructure and linguistic indicators suggesting that Chinese-speaking victims were targeted. 

It is of concern that the campaign may easily be extended to international targets based on some phishing prompts that dynamically adapt to the language settings of the infected application. Furthermore, the operation has been linked to the previously identified SparkKitty malware cluster, which was discovered last year, based on overlapping distribution tactics, cryptocurrency-centered targeting patterns, Chinese-language debugging strings within the malicious code, and the inclusion of SparkKitty-related components within several analyzed programs. 

When the findings were disclosed to Apple, they were notified and the identified malicious applications have since been removed from the App Store. According to court records reviewed by Forbes, the incident occurred as a result of a targeted home invasion last month in Winnetka, where attackers allegedly used social engineering tactics to gain physical access to the victim's property. 

Investigators reported that a man impersonating a food delivery driver approached the residence and knocked on the front door before at least four armed accomplices gained access moments after the resident responded. Once inside, the group demanded access to a secure safe as well as credentials related to online cryptocurrency accounts, emphasizing the increasing convergence between the targeting of digital assets and conventional violent crimes.

A report by authorities indicates that the operation failed in achieving its intended objective after the victim escaped the residence, leading the suspects to depart the scene without obtaining any known cryptocurrency assets. 

In spite of the attempted robbery, organized groups have increasingly combined physical coercion with identity deception and intelligence-driven targeting to compromise high-value cryptocurrency holders. It is believed that the investigation developed into a broader criminal case involving Chicago rapper Lil Zay Osama, formally known as Isaiah Dukes, along with five additional suspects, were alleged to have kidnapped children and committed a violent cryptocurrency-related robbery. 

Dukes has entered a not guilty plea to the latest charges after previously serving a 14-month prison sentence for unlawful possession of a machine gun in 2024. According to reports, investigators used unconventional but highly effective digital forensics methods in order to identify members of the group after one suspect connected his iPhone to a stolen getaway vehicle's Bluetooth interface.

The combination of the infotainment pairing logs and the subpoenaed Apple records provided authorities with information that allowed them to locate the connected device in a iCloud account belonging to Tyrese Fenton-Watson. The discovery was significant as it demonstrated how telemetry generated by connected consumer technologies, such as smartphone synchronization and in-vehicle wireless systems, is becoming an increasingly important tool for criminal investigations in modern times.

Technology and cybersecurity landscapes were also subject to increasing scrutiny due to the emergence of artificial intelligence, surveillance practices, and digital governance concerns. Anthropic's reported intention to broaden access to its advanced "Mythos" model, which was originally restricted to approximately 40 organizations due to concerns surrounding misuse of the system and offensive security applications. This model is designed with large-scale cyber vulnerability discovery capabilities and is designed to detect cyber vulnerabilities on a large scale.

Reports in The Wall Street Journal indicated that the company hoped to expand its availability to approximately 120 companies, though White House officials expressed reservations about both national security implications and the potential strain on Anthropic's infrastructure and disruption of government access to the technology that could result from excessive external usage. 

In addition, further revelations indicated that the boundary between the deployment of AI, the privacy of users, and digital surveillance is increasingly blurred. In a report published by Wired, it was reported that the DHS had requested location and identification information from Google regarding a Canadian user who criticized the Trump administration, but it is unclear whether Google complied with this request. 

Additionally, Meta disclosed that Facebook and Instagram were using artificial intelligence-driven bone structure analysis to detect whether users are under the age of 13. According to security researcher Jeremiah Fowler, nearly 90,000 screenshots allegedly extracted from a celebrity's smartphone had been exposed as a result of spyware exposure, including sensitive photos, financial records, and private conversations, further illustrating the degree of personal data risks associated with commercial surveillance tools.

A significant amount of industry attention was also drawn to Forbes' publication of its eighth annual AI 50 ranking in partnership with Mayfield, highlighting some of the leading private AI firms, including Harvey and ElevenLabs, along with emerging startups, including Gamma, Chai Discovery, and Rogo. In addition, the AI 50 Brink list highlighted early-stage companies that were expected to compete effectively with more established companies. 

During the investigation, law enforcement agencies also recorded a notable operational success after cooperating with Meta and international authorities to dismantle nine cryptocurrency scam centers and arrest more than 275 individuals allegedly involved in fraudulent schemes targeting Americans. This marks a rare instance of coordinated action between the Department of Justice and China's Ministry of Public Security. 

A report alleging that workers employed by contractor Sama encountered explicit and sensitive footage while annotating video captured through Ray-Ban smart glasses prompted Meta to be subjected to renewed scrutiny for its privacy oversight. As a result of these allegations, Meta terminated its relationship with Sama shortly before terminating its agreement due to an unmet standard, a claim Sama denied publicly. 

Following the latest developments, the company issued a series of critical software updates to resolve vulnerabilities affecting Siri, the company's voice-based digital assistant, resulting in the potential for unauthorized access to sensitive user information on locked mobile devices. These updates further renewed attention to mobile device security. It was found that the assistant was capable of processing certain voice interactions even while the device was locked, allowing attackers who possessed iPhones or other Apple hardware to access contact information and additional private data without complete authentication if they had physical possession of the devices. 

As a result, Apple introduced security enhancements as a means of limiting Siri's functionality when devices are immobilized. By doing so, Apple reduces the likelihood that unauthorized commands may be executed while the device is immobilized as well as strengthening protections against physical access attacks. Several products within Apple's ecosystem, including iPhone, Apple Watch, iPadOS, and macOS Ventura systems, have been patched as part of broader platform security updates to mitigate the vulnerabilities.

Several software updates have been recommended to ensure that vulnerabilities are fully mitigated across all supported devices, including iOS 17.6 and iPadOS 17.6, by using the standard settings, general, and software update process. 

Collectively, these incidents reflect a rapidly evolving threat environment in which cybercrime, artificial intelligence, connected consumer technologies, and digital surveillance are becoming increasingly interconnected. This collection of cases illustrates how both attackers and law enforcement are leveraging the expanding data footprint created by modern devices and online services in order to infiltrate trusted app ecosystems with malicious cryptocurrency wallet campaigns as well as investigators using Bluetooth telemetry and cloud account records to investigate violent crimes. 

Furthermore, growing concerns surrounding the discovery of vulnerabilities using artificial intelligence, spyware-linked data exposure, biometric analysis, and voice assistant security continue to increase pressure for technology companies to strengthen platform security measures while maintaining a balance between privacy, accessibility, and operational transparency. 

Increasing sophistication and technical integration of cyber-enabled financial crime underscores the importance of proactive security updates, stricter application vetting, and enhanced awareness of consumers in increasingly interconnected digital ecosystems as cyber-enabled financial crime becomes more sophisticated and technologically integrated.
Read more »
Ledger
Crypto Wallet Crypto Wallet Theft cryptocurrency Cryptocurrency threats Cyber Phishing Cyber Security Ledger

Trezor and Ledger Impersonated in Physical QR Code Phishing Scam Targeting Crypto Wallet Users

 

Nowadays criminals push fake crypto warnings through paper mail, copying real product packaging from firms like Trezor and Ledger. These printed notes arrive at homes without digital traces, making them feel more trustworthy than email scams. Instead of online messages, fraudsters now use stamps and envelopes to mimic official communication. Because it comes in an envelope, people may believe the request is genuine. Through these letters, attackers aim to steal secret backup codes used to restore wallets. Physical delivery gives the illusion of authenticity, even though the goal remains theft. The method shifts away from screens but keeps the same deceitful intent. 

Pretending to come from company security units, these fake messages tell recipients they need to finish an urgent "Verification Step" or risk being locked out of their wallets. A countdown appears on screen, pushing people to act fast - slowing down feels risky when time runs short. Opening the link means scanning a barcode first, then moving through steps laid out by the site. Pressure builds because delays supposedly lead to immediate consequences. Following directions seems logical under such conditions, especially if trust in the sender feels justified. 

A single message pretending to come from Trezor told users about an upcoming Authentication Check required before February 15, 2026, otherwise access to Trezor Suite could be interrupted. In much the same way, another forged notice aimed at Ledger customers claimed a Transaction Check would turn mandatory, with reduced features expected after October 15, 2025, unless acted upon. Each of these deceptive messages leads people to fake sites designed to look nearly identical to real setup portals. BleepingComputer’s coverage shows the QR codes redirect to websites mimicking real company systems. 

Instead of clear guidance, these fake sites display alerts - claiming accounts may be limited, transactions could fail, or upgrades might stall without immediate action. One warning follows another, each more urgent than the last, pulling users deeper into the trap. Gradually, they reach a point where entering their crypto wallet recovery words seems like the only option left. Fake websites prompt people to type in their 12-, 20-, or 24-word recovery codes, claiming it's needed to confirm device control and turn on protection. 

Though entered privately, those words get sent straight to servers run by criminals. Because these attackers now hold the key, they rebuild the digital wallet elsewhere without delay. Money vanishes quickly after replication occurs. Fewer scammers send fake crypto offers by post, even though email tricks happen daily. Still, real-world fraud attempts using paper mail have appeared before. 

At times, crooks shipped altered hardware wallets meant to steal recovery words at first use. This latest effort shows hackers still test physical channels, especially if past leaks handed them home addresses. Even after past leaks at both Trezor and Ledger revealed user emails, there's no proof those events triggered this specific attack. However the hackers found their targets, one truth holds - your recovery phrase stays private, always. 

Though prior lapses raised alarms, they didn’t require sharing keys; just like now, safety lives in secrecy. Because access begins where trust ends, never hand over seed words. Even when pressure builds, silence protects better than any tool. Imagine a single line of words holding total power over digital money - this is what a recovery phrase does. Ownership shifts completely when someone else learns your seed phrase; control follows instantly. Companies making secure crypto devices do not ask customers to type these codes online or send them through messages. 

Scanning it, emailing it, even mailing it physically - none of this ever happens if the provider is real. Trust vanishes fast when any official brand demands such sharing. Never type a recovery phrase anywhere except the hardware wallet during setup. When messages arrive with urgent requests, skip the QR scans entirely. Official sites hold the real answers - check there first. A single mistake could expose everything. Trust only what you confirm yourself.  

A shift in cyber threats emerges as fake letters appear alongside rising crypto use. Not just online messages now - paper mail becomes a tool for stealing digital assets. The method adapts, reaching inboxes on paper before screens. Physical envelopes carry hidden risks once limited to spam folders. Fraud finds new paths when trust in printed words remains high.
Read more »
Ransom
Coinbase Crypto Crypto Wallet cryptocurrency Cyber Security Data Theft Extortion Ransom

$400Million Coinbase Breach Linked to Customer Data Leak from India


Coinbase data breach linked to India

A Reuters investigation revealed that cryptocurrency exchange Coinbase knew in January about a breach affecting outsourced customer support agents in India. Six people who knew about the incident said Coinbase was aware of sensitive user data compromise through its contractor, TaskUs, before it was officially announced in May. 

On 14th May, TaskUs filed an SEC document revealing that an India-based TaskUs employee was found taking pictures of a computer screen with her phone. Five former TaskUs employees confirmed that the worker and one accomplice were bribed by threat actors to get Coinbase user data.

The breach cost $400 million

After this information, more than 200 TaskUs employees were fired in a mass layoff from the Indore center, which drew media attention in India. Earlier, Coinbase suspected ‘overseas support agents’ but now the breach is estimated to cost 400 million dollars.

Coinbase had been a long-term partner of TaskUs, a Texas-based outsourcing firm, cost-cutting labor by giving customer support work to offshore teams. After 2017, TaskUs agents, mostly from developing countries, handled Coinbase customer inquiries. 

In the May SEC filing, Coinbase said it didn’t know about the full scale of the breach until it received an extortion demand of $20 Million on 11th May. As a cautionary measure, Coinbase cut ties with TaskUs employees and other unknown foreign actors. Coinbase has notified regulators, compensated affected users, and taken strict measures to strengthen security. 

In a public statement, TaskUs confirmed it had fired two staff (unnamed) for data theft but didn’t mention Coinbase. The company found the two staff involved in a cyber attack campaign that targeted other service providers linked to the client. 

Hackers use social engineering tactic

Hackers did not breach the Coinbase crypto wallets directly, they cleverly used the stolen information to impersonate the Coinbase employees in a series of social engineering scams. The hackers posed as support agents, fooling victims into transferring their crypto assets. 

According to Money Control, “The person familiar with the matter confirmed that Coinbase was the client and that the incident took place in January. Reuters could not determine whether any arrests have been made. Police in Indore did not return a message seeking comment.”

Read more »
Technology
Crypto Wallet Google Analyst Quantum computing RSA Encryption Technology

Google Researcher Claims Quantum Computing Could Break Bitcoin-like Encryption Easier Than Thought

 

Craig Gidney, a Google Quantum AI researcher, has published a new study that suggests cracking popular RSA encryption would take 20 times less quantum resources than previously believed.

Bitcoin, and other cryptocurrencies were not specifically mentioned in the study; instead, it focused on the encryption techniques that serve as the technical foundation for safeguarding cryptocurrency wallets and, occasionally, transactions.

RSA is a public-key encryption method that can encrypt and decrypt data. It uses two separate but connected keys: a public key for encryption and a private key for decryption. Bitcoin does not employ RSA and instead relies on elliptic curve cryptography. However, ECC can be overcome by Shor's algorithm, a quantum method designed to factor huge numbers or solve logarithm issues, which is at the heart of public key cryptography.

ECC is a method of locking and unlocking digital data that uses mathematical calculations known as curves (which compute only in one direction) rather than large integers. Consider it a smaller key that has the same strength as a larger one. While 256-bit ECC keys are much more secure than 2048-bit RSA keys, quantum risks scale nonlinearly, and research like Gidney's shrinks the period by which such assaults become feasible.

“I estimate that a 2048-bit RSA integer could be factored in under a week by a quantum computer with fewer than one million noisy qubits,” Gidney explained. This was a stark revision from his 2019 article, which projected such a feat would take 20 million qubits and eight hours. 

To be clear, no such machine exists yet. Condor, IBM's most powerful quantum processor to date, contains little over 1,100 qubits, while Google's Sycamore has 53. Quantum computing applies quantum mechanics concepts by replacing standard bits with quantum bits, or qubits. 

Unlike bits, which can only represent 0 or 1, qubits can represent both 0 and 1 at the same time due to quantum phenomena such as superposition and entanglement. This enables quantum computers to execute several calculations concurrently, potentially solving issues that are now unsolvable for classical computers. 

"This is a 20-fold decrease in the number of qubits from our previous estimate,” Gidney added. A 20x increase in quantum cost estimation efficiency for RSA might be an indication of algorithmic patterns that eventually extend to ECC. RSA is still commonly employed in certificate authorities, TLS, and email encryption—all of which are essential components of the infrastructure that crypto often relies on.
Read more »
phishing
Coinbase credit freeze Crypto Wallet cryptocurrency Cybersecurity Data Breach Identity Theft phishing

Coinbase Confirms Data Breach Impacting Over 69,000 Users, Refuses $20M Extortion Demand

 

Coinbase, the leading cryptocurrency exchange in the United States, disclosed a recent cybersecurity breach affecting 69,461 users, according to a notification submitted to the Maine attorney general’s office. Although the hackers failed to access individual accounts or sensitive login details such as two-factor authentication codes, private keys, or crypto wallets, they were able to obtain a wide array of personal data.

The compromised information includes:
  • Full names
  • Residential addresses
  • Phone numbers
  • Email addresses
  • Partial Social Security numbers
  • Masked bank account details
  • Government-issued ID images (e.g., driver’s licenses, passports)
  • Account-related data such as transaction history and snapshots
In an SEC filing, Coinbase revealed that the attackers paid offshore contractors to gain access to internal systems. This information was weaponized to launch a social engineering scam. The perpetrators demanded $20 million in exchange for not leaking the stolen data—an offer Coinbase declined.

"Instead of funding criminal activity, we have investigated the incident, reinforced our controls, and will reimburse customers impacted by this incident," the company said in its statement.

Coinbase is currently collaborating with law enforcement and has established a $20 million reward fund to incentivize tips that could lead to the identification and capture of the individuals responsible.

Meanwhile, reports on Reddit suggest that some users received unsolicited password reset notifications as early as last week. It is still unclear whether these incidents are directly connected to the breach. CNET contacted Coinbase for a response, but no comment was issued at the time.

Steps to Protect Your Crypto and Data
Although Coinbase has confirmed that seed phrases and investor accounts remain secure, the exposure of personal data is significant. Here’s what you should do now to safeguard your information:

1. Use a Cold Wallet
security, coldwallet, hardwarewallet, cryptoassets
For regular crypto investors, shifting funds to a cold wallet—a device not connected to the internet—can provide an extra layer of security in case of future breaches

2. Freeze Your Credit Reports
creditfreeze, SSN, financialsecurity
Freeze your credit reports with all three major bureaus and consider placing a lock on your Social Security number to prevent identity misuse. Be cautious of phishing attempts that may exploit this situation.

"It's worth the hassle of setting up accounts with all three major credit bureaus. I get peace of mind at zero cost to me," said Danni Santana, CNET’s identity theft editor.

3. Notify Your Bank
banking, accountsecurity, financialfraud
Even if only partial account information was exposed, contact your bank to report the incident. You may want to open new checking or savings accounts as a precaution.

4. Enroll in Identity Monitoring Services
identitytheft, monitoring, datasecurity, insurance
Opt into a free credit and identity monitoring service. While these platforms don’t take direct action, they provide alerts if your data appears on the dark web. Paid services like Aura go further, offering identity restoration support and up to $1 million in identity theft insurance.
Read more »
North Korea Hackers
Crypto Wallet Cyber Fraud Fake Firm Lazarus Group North Korea Hackers

North Korean Hackers Create Fake U.S. Firms to Dupe Crypto Developers

 

Threat analysts at Silent Push, a U.S. cybersecurity firm, told Reuters that North Korean cyber spies established two companies in the U.S., Blocknovas LLC and Softglide LLC, using fictitious personas and addresses to infect developers in the cryptocurrency industry with malicious software, in violation of Treasury sanctions. A third firm, Angeloper Agency, is connected to the campaign but does not seem to be registered in the United States. 

“This is a rare example of North Korean hackers actually managing to set up legal corporate entities in the U.S. in order to create corporate fronts used to attack unsuspecting job applicants,” noted Kasey Best, director of threat intelligence at Silent Push. 

The hackers are members of a subsection inside the Lazarus Group, an elite team of North Korean hackers which is part of the Reconnaissance General Bureau, Pyongyang’s principal foreign intelligence agency, Silent Push added. 

Blocknovas and Softglide were not explicitly mentioned by the FBI. On Thursday, however, the FBI submitted a seizure notice on Blocknovas' website, stating that the name was taken "as part of a law enforcement action against North Korean Cyber Actors who utilised this domain to deceive individuals with fake job postings and distribute malware."

FBI sources told Reuters ahead of the seizure that the agency is still "focused on imposing risks and consequences, not only on the DPRK actors themselves, but anybody who is facilitating their ability to conduct these schemes.” 

One FBI officer stated that North Korean cyber operations are "perhaps one of the most advanced persistent threats" to the United States. The North Korean delegation to the United Nations in New York did not immediately respond to a request for comment. 

“These attacks utilize fake personas offering job interviews, which lead to sophisticated malware deployments in order to compromise the cryptocurrency wallets of developers, and they also target the developers' passwords and credentials which could be used to further attacks on legitimate businesses,” Best stated. 

Silent Push was able to authenticate several victims of the operation, "specifically via Blocknovas, which is by far the most active of the three front companies," the researchers stated in their report.
Read more »
Databreach
Crypto Wallet Cryptocurrency Breach Cyber Fraud Cyberattacks Cybersecurity Databreach

$494 Million Stolen in Cryptocurrency Wallet Breaches This Year

 


As a result of the churning threat landscape, new threats are always emerging while others disappear or fade into irrelevance. Wallet drainers trick their victims into signing malicious transactions in order to steal their assets. As the name implies, Wallet Drainer is a malicious malware that is used on phishing websites in order to steal crypto assets through the enticement of users to sign malicious transactions. It was estimated that such attacks would result in an average loss of about $494 million in 2024. 

As part of its web3 anti-scam platform, Scam Sniffer, which has been monitoring wallet drainer activity for some time, these insights are derived. Previously, the platform has flagged attacks that have affected up to 100,000 people at the same time, and these tools are phishing tools that are intended to swindle cryptocurrency from users' wallets through fake or compromised websites, thereby stealing money from the wallets of users. 

As a result of the thefts, 30 large-scale thefts involving more than $1 million were reported, with the largest single heist being worth $55.4 million. As a result of this, the number of victims increased by a whopping 6.7% compared to 2023, suggesting that victims held higher amounts on average. According to web3's anti-scam platform, Scam Sniffer, which has been tracking wallet drainer activity for some time now has reported attack waves that have affected up to 100,000 individuals at the same time. The large-scale theft incidents in 2024 were characterized by distinct phases of fraud, phishing, and other sophisticated methods for stealing digital assets. 

The purpose of wallet drainers is to trick users into connecting their wallets to suspicious websites or applications in order to steal digital assets. The first halff of the year (January-June) saw frequent, but smaller-scale incidents, resulting in individual losses that ranged from $1-8 million. In August and September, major losses accounted for 52% of the year's total large-scale losses, with $55.48 million and $32.51 million losses respectively during August and September. 

There was a significant reduction in both frequency and scale of losses during the final quarter, with individual losses typically ranging between $2-6 million, which indicated a significant improvement in market awareness of security threats. It was announced in the second quarter of this year that a drainer service known as Pink Drainer had halted operations, previously known for impersonating journalists in phishing attacks, used to compromise Discord and Twitter accounts in the name of cryptocurrency theft, has been seen to be a drainer service. This caused a decrease in phishing activity, but the scammers gradually picked up the pace in the third quarter, with the Inferno service taking the lead in August and September by causing $110 million in losses. 

The final quarter of the year was considered to be one of the quieter quarters of the year. The annual losses were only about 10.3% of the total losses recorded during 2024 as a whole. Acedrainer emerged at that time as a major player as well, claiming 20% of the drainer market, according to ScamSniffer. It was reported that a total of 90,000 victims had been identified in the second and third quarters when the losses combined ttotalled$257 million; an additional 30,000 victims had been observed in the fourth quarter, which resulted in $51 million in losses. 

There were more attacks in 2024 than at the beginning of the year, but in August and September, in particular, the two largest attacks of last year were observed, at $55.48 million and $32.51 million, respectively. According to this report, Q1 was the busiest time of the year for phishing website activity, resulting in a high rate of theft. The market adjustments made in the second half of the year, as well as the exit of major drainers such as Pink and Inferno, contributed to reduced activity levels in the second half of the year." Scam Sniffer notes. 

As far as tactics were concerned, scammers became more creative during 2024. A study by Scam Sniffer found a significant increase in the use of fake CAPTCHAs and Cloudflare pages, as well as IPFS deployments in order to evade detection. Attackers are also heavily reliant on specific signature types in order to evade detection. In 56.7% of thefts, the “Permit” signature is used to authorize token expenditure, whereas in 31.9%, the “setOwner” signature is used to change ownership rights or admin rights in smart contracts. 

It was also noted that Google Adwords and Twitter ads were used by attackers to lure victims to phishing websites. Attackers manipulated compromised accounts, bots, and fake token airdrops to reel people in through these channels. 

Defending Against Cryptocurrency Attacks 

Currently, cryptocurrency scams are on the rise, so users need to take proactive measures to protect their assets from being harmed, as the prevalence of these scams is on the rise. It is emphasized by experts that one should only interact with vetted websites to reduce exposure to fraudulent platforms. 

To prevent falling victim to phishing schemes, it is equally important that one verifies URLs meticulously before engaging in any transaction. Additionally, users are encouraged to carefully review the transaction approval prompts in order to verify that the details presented are accurate. The ability to simulate a transaction before proceeding increases the level of security by allowing individuals to identify potential risks before investing money. This is a key recommendation that should not be overlooked as well. 

In addition to these practices, it is also advisable to use the built-in wallet warnings for malicious activities. It is common for modern wallets to provide users with alerts that can help detect suspicious behaviour, allowing them to take action before it's too late. It is also possible to remove unauthorized or suspicious permissions from wallets by using token revocation tools. In addition, as cryptocurrency adoption grows globally, there will come a rising trend towards the sophistication of scams that will accompany it. 

Users must remain vigilant, and use the best practices and tools available to ensure that they navigate this evolving landscape safely and effectively in the future. In a constantly changing threat environment, it will be imperative to maintain a proactive approach to security in order to safeguard digital assets.
Read more »
ZKP
Crypto Wallet Data Privacy Technology Web3 ZKP

ZKP Emerged as the "Must-Have" Component of Blockchain Security.

 

Zero-knowledge proof (ZKP) has emerged as a critical security component in Web3 and blockchain because it ensures data integrity and increases privacy. It accomplishes this by allowing verification without exposing data. ZKP is employed on cryptocurrency exchanges to validate transaction volumes or values while safeguarding the user's personal information.

In addition to ensuring privacy, it protects against fraud. Zero-knowledge cryptography, a class of algorithms that includes ZKP, enables complex interactions and strengthens blockchain security. Data is safeguarded from unauthorised access and modification while it moves through decentralised networks. 

Blockchain users are frequently asked to certify that they have sufficient funds to execute a transaction, but they may not necessarily want to disclose their whole amount. ZKP can verify that users meet the necessary standards during KYC processes on cryptocurrency exchanges without requiring users to share their paperwork. Building on this, Holonym offered Human Keys to ensure security and privacy in Zero Trust situations. 

Each person is given a unique key that they can use to unlock their security and privacy rights. It strengthens individual rights through robust decentralised protocols and configurable privacy. The privacy-preserving principle applies to several elements of Web3 data security. ZKP involves complex cryptographic validations, and any effort to change the data invalidates the proof. 

Trustless data processing eases smart contract developer work 

Smart contract developers are now working with their hands tied, limited to self-referential opcodes that cannot provide the information required to assess blockchain activities. To that end, the Space and Time platform's emphasis on enabling trustless, multichain data processing and strengthening smart contracts is worth mentioning, since it ultimately simplifies developers' work. 

Their SXT Chain, a ZKP data blockchain, is now live on testnet. It combines decentralised data storage and blockchain verification. Conventional blockchains are focused on transactions, however SXT Chain allows for advanced data querying and analysis while preserving data integrity through blockchain technology.

The flagship DeFi generation introduced yield farming and platforms like Aave and Uniswap. The new one includes tokenized real-world assets, blockchain lending with dynamic interest rates, cross-chain derivatives, and increasingly complicated financial products. 

To unlock Web3 use cases, a crypto-native, trustless query engine is required, which allows for more advanced DeFi by providing smart contracts with the necessary context. Space and Time is helping to offer one by extending on Chainlink's aggregated data points with a SQL database, allowing smart contract authors to execute SQL processing on any part of Ethereum's history. 

Effective and fair regulatory model 

ZKP allows for selective disclosure, in which just the information that regulators require is revealed. Web3 projects comply with KYC and AML rules while protecting user privacy. ZKP even opens up the possibility of a tiered regulation mechanism based on existing privacy models. Observers can examine the ledger for unusual variations and report any suspect accounts or transactions to higher-level regulators. 

Higher-level regulators reveal particular transaction data. The process is supported by zero-knowledge SNARKs (Succinct Non-interactive Arguments of Knowledge) and attribute-based encryption. These techniques use ZKP to ensure consistency between transaction and regulatory information, preventing the use of fake information to escape monitoring. 

Additionally, ZK solutions let users withdraw funds in a matter of minutes, whereas optimistic rollups take approximately a week to finalise transactions and process withdrawals.
Read more »
Webflow
Crypto Wallet Cyber Fraud Phishing Site User Privacy Webflow

Webflow Sites Employed to Trick Users Into Sharing Login Details

 

Security experts have warned of an upsurge in phishing pages built with Webflow, a website builder tool, as attackers continue to use legitimate services such as Microsoft Sway and Cloudflare. 

The malicious campaign targets login credentials for multiple corporate webmail services, Microsoft 365 login credentials, and sensitive data from cryptocurrency wallets like Coinbase, MetaMask, Phantom, Trezor, and Bitbuy.

According to the researchers, between April and September 2024, the number of visitors to Webflow-created phishing pages jumped tenfold, and the attacks targeted over 120 organisations worldwide. The majority of the people targeted work in the banking, technology, and financial services industries in North America and Asia.

Attackers have utilised Webflow to create standalone phishing pages as well as to redirect unsuspecting users to additional phishing pages under their control. Because there are no phishing lines of code to write and identify, the former provides attackers with convenience and stealth, but the latter allows them to carry out more complex activities as required. 

Webflow is far more appealing than Cloudflare R2 or Microsoft Sway since it allows clients to create custom subdomains for free, as opposed to auto-generated random alphanumeric subdomains, which are likely to raise suspicion.

To increase the chances of success, phishing sites are designed to resemble the login pages of their legitimate counterparts. This method is used to deceive users into disclosing their credentials, which are subsequently at times exfiltrated to another server. 

Security experts have also discovered Webflow cryptocurrency phoney websites that use screenshots of genuine wallet homepages as their landing pages. When a visitor clicks anywhere on the fake website, they are taken to the real scam site. The final goal of a crypto-phishing campaign is to gain the victim's seed phrases, allowing the attackers to take over cryptocurrency wallets and pilfer funds. 

When users enter the recovery phrase in one of the assaults identified by the cybersecurity firm, they are presented with an error message saying that their account has been suspended due to "unauthorised activity and identification failure." Additionally, the message directs the user to start an online chat session on Tawk.to to contact their support personnel. 

It is worth noting that Avast's CryptoCore fraud operation exploited chat services such as LiveChat, Tawk.to, and Smartsupp. Instead of using search engines or clicking on other links, users should always enter the URL into their web browser to access important pages like their webmail or banking portal.
Read more »
SpyAgent
Crypto Crypto Wallet malware McAfee SpyAgent

SpyAgent Malware Uses OCR Tech to Attack Crypto Wallets

SpyAgent Malware Uses OCR Tech to Attack Crypto Wallets

Malware Using OCR to Steal Crypto Keys

Cybersecurity experts have found a new malware threat that lures users into downloading a malicious app to grow. An advanced malware strain campaign has surfaced from North Korea, it attacks cryptocurrency wallets by exploiting the mnemonic keys of the users. McAfee researcher SangRyo found the malware after tracking stolen data from malicious apps for breaking servers and gaining access. 

The working of SpyAgent

The malware is called SpyAgent, and it targets cryptocurrency enthusiasts. What makes this malware unique is its ability to use OCR technology for scanning images, it leverages Optical Character Recognition (OCR) technology to steal mnemonic keys stored in the images of infected devices. Hackers use these mnemonic keys to gain unauthorized entry into digital assets. 

These keys are twelve-word phrases used for recovering cryptocurrency wallets. There has been a rise in the use of mnemonic phrases for crypto wallet security because they are easy to remember if compared to a long strain of random characters. 

Spy Agent pretends to be a legitimate application, such as banking, streaming, government services, or utility software. McAfee has discovered over 280 fake applications.

Distribution of SpyAgent

When a victim downloads a malicious app containing SpyAgent, the malware builds a command and control  (C2 )server that allows threat actors to launch remote commands. Later, the attacker extracts contact lists, text messages, and stored images from the compromised device. 

“Due to the server’s misconfiguration, not only were its internal components unintentionally exposed, but the sensitive personal data of victims, which had been compromised, also became publicly accessible. In the ‘uploads’ directory, individual folders were found, each containing photos collected from the victims, highlighting the severity of the data breach,” the report says.

Reach of SpyAgent

SpyAgent has been found working in Korea, but its range has widened to other countries as well. The malware is capable of disguising itself as a legitimate application, which makes it dangerous. SpyAgent has recently expanded to the United Kingdom. 

It has also moved from simple HTTP requests to web socket connections, allowing real-time two-way communication with the C2 server. It escapes security researchers via techniques like function remaining and string encoding. 

The McAfee report recommends “users to be cautious about their actions, like installing apps and granting permissions. It is advisable to keep important information securely stored and isolated from devices. Security software has become not just a recommendation but a necessity for protecting devices.”

Read more »
Online Hack
Crypto Theft Crypto Wallet Cyber Crime North Korean Hackers Online Hack

Notorious Lazarus Hacking Outfit Linked to a $60 Million Alphapo Crypto Theft

 

The latest attack on payment processing site Alphapo, in which the attackers stole over $60 million in cryptocurrency, is attributed by blockchain researchers to the North Korean Lazarus hacker gang.

The hack on Sunday, July 23rd, targeted Alphapo, a centralised cryptocurrency payment provider for gaming websites, e-commerce subscription services, and other online platforms. The initial sum stolen is thought to have been $23 million. Over 6 million USDT, 108k USDC, 100.2 million FTN, 430k TFL, 2.5k ETH, and 1,700 DAI were stolen from hot wallets, most likely as a result of a private key leak. The total cash taken from Alphapo has already reached $60,000,000, according to data from Dune Analytics, which was also spotted by renowned crypto chain investigator "ZackXBT" earlier this week. 

Furthermore, ZackXBT claimed that the heist looks to have elements of a Lazarus attack and supported the claim by stating that Lazarus leaves "a very distinct fingerprint on-chain," but no additional information was provided. 

The $35 million Atomic Wallet theft, the $100 million Harmony Horizon hack, and the $617 million Axie Infinity theft were all attributed to the North Korean threat actor known as The Lazarus Group, which has ties to the North Korean government. 

Typically, Lazarus employs fake job offers to tempt employees of crypto companies to open malicious files, compromise their devices, and steal their login information.

This opens up a potential attack route into the victim's employer's network, where they can gain access without authorization and meticulously plan and carry out expensive attacks. 

Laundering attempts were made through Bitget, Bybit, and other services, according to analysts monitoring the flow of stolen money to cryptocurrency exchanges. Lazarus is also renowned for utilising specialised services for mixing small amounts of cryptocurrencies. 

The attackers probably took the private keys that gave them access to the wallets, Dave Schwed, COO of the blockchain security firm Halborn, stated.

"While we lack specifics, it seems that the alleged "hack" likely pertains to the theft of private keys. This inference comes from observing the movement of funds from independent hot wallets and the sudden halting of trading," he explained. "Moreover, the subsequent transactions have led ZachXBT, a renowned "on-chain sleuth", to surmise that North Korea's notorious Lazarus group is the perpetrator of this attack. Given their history of similar exploits, I find myself agreeing with this theory."
Read more »
Vulnerabilities and Exploits
Crypto Wallet Data Safety Security Vulnerabilities and Exploits

This New macOS Info-stealer in Town is Targeting Crypto Wallets

 

A new info-stealer malware has been identified, designed to steal a wide range of personal data, comprising local files, cookies, financial information, and passwords stored in macOS browsers. It's called Atomic macOS Stealer (aka AMOS, or simply Atomic), and its developer is constantly adding new capabilities to it. 

The most recent update was issued on April 25. According to the Cyble research team, Atomic is available on a private Telegram channel for a $1,000 monthly fee. A DMG installer file, a cryptocurrency checker, the brute-forcing program MetaMask, and a web panel to oversee assault campaigns are all provided to the customer.

The malicious DMG file is designed to avoid detection and has been identified as malware by only one (out of 59) AV engines on VirusTotal. When the victim runs this DMG file, it displays a password prompt disguised as a macOS system notice, encouraging the user to input the system password.

After getting the system password, it attempts to steal passwords stored in the default password management tool Keychain. This includes WiFi passwords, credit card information, site logins, and other critical information. Atomic is built with a variety of data-theft features, allowing its operators to target various browsers and crypto wallets, among other things.

It checks the system for installed applications in order to steal information from it. Cryptocurrency wallets (Binance, Electrum, Atomic, and Exodus) and web browsers (Google Chrome, Microsoft Edge, Firefox, Opera, Yandex, and Vivaldi) are among the programs targeted.

It also targets over 50 cryptocurrency wallet extensions, such as Coinbase, Yoroi, BinanceChain, Jaxx Liberty, and Guarda. Furthermore, it attempts to steal system information such as the Model name, RAM size, number of cores, serial number, UUID number, and others.

Atomic is another example of the growing number of cyber dangers threatening macOS. Researchers have already discovered two new threats, the RustBucket Malware and a new LockBit variation, indicating an interest in Apple's core operating system, which powers Mac computers.

As a result, it is past time for Mac users to recognise the growing threat and enhance their security posture.
Read more »
Security
Aurora Crypto Wallet Data Infostealer malware Safety Security

Aurora Infostealer Malware Uses Shapeshifting Techniques

 

One of the most recent discoveries was the Aurora Stealer malware, which imitated popular applications in order to infect as many users as possible.

Cyble researchers discovered that threat actors are actively changing and customizing their phishing websites in order to target a wide range of well-known applications. Aurora is interested in data from web browsers and cryptocurrency wallets, among other things.

Aurora, the Shapeshifting Thief

Aurora has been marketed as a stealer on Telegram and darknet forums since late August 2022. Malware-as-a-service costs $250 per month or $1500 for a lifetime license.

Cyble Research and Intelligence Labs (CRIL) discovered a phishing website (hxxps[:]/messenger-download[.]top) claiming to be a website for a chat app on January 16th, 2023. The next day, the same webpage impersonated the official TeamViewer website.
 
According to the researchers' report, the malware file gathers system information using Windows Management Instrumentation (WMI) commands, including the operating system's name, the graphics card's name, and the processor's name.

Furthermore, the malware persists in collecting system information such as the username, Hardware Identification (HWID), RAM size, screen resolution, and IP address. Furthermore, the malware searches the installed directories for specific browser-related files saved in SQLite, such as Cookies, History, Login Data, and Web Data by scanning the directories of installed browsers on the victim's computer.

The stealer then continues to extract crypto wallet data by querying and reading files from specific directories. It also grabs information from cryptocurrency wallet browser extensions. As per researchers, over 100 extensions have been specifically targeted and hard coded into the stealer binary.

Other stealers, such as RedLine, Vidar, and RecordBreaker, have been found padding malware samples with unnecessary data in order to avoid detection, according to CSN.

You can immensely decrease your chances of becoming a victim by using multi-factor authentication and strong passwords whenever possible. Additionally, enable automatic software updates and educate employees on how to protect themselves against threats such as phishing and unsafe URLs.
Read more »
Vulnerabilities and Exploits
and Exploits Cloud Service Crypto Wallet Google Imperva Red Security Breach Vulnerabilities Vulnerabilities and Exploits

Over 2.5 Billion Google Chrome Users' Information was Breached

 


It is no longer necessary for a person to commute to a physical location to find information about anything they are interested in. 

Currently, Google can be trusted to provide the most relevant information about anything and everything. Google has a wealth of information available at the click of a button. Data threat risk is also growing along with the acceptance of cloud services leading to the rise of data breaches. 

With billions of users, Google Chrome is gaining an increasing amount of popularity as one of the most popular web browsers. 

According to the cyber security firm Imperva Red, a vulnerability in Google Chrome and Chromium browsers could expose the data of over 2.5 billion users worldwide to the risk of theft or other harm. 

The company is reporting that a vulnerability known as CVE-2022-3656 can be exploited to steal private information, such as the login credentials of cloud providers and crypto wallets. An assessment of how the browser interacts with the file system found a vulnerability in the way the browser works with the file system. According to the blog, the purpose of this experiment was primarily to examine how browsers handle symlinks to find widespread issues. 

It should be noted that a symbolic link is a kind of file that points to a different file or directory, as defined by Imperva Red. A symlink can therefore be treated by the operating system as if it were a regular file or directory. This means that the operating system can access it as though it were physically present. A symlink could be useful if you want to create shortcuts, change the path of a file, or organize your files more flexibly according to the manual. 

There is also a possibility that these links could be exploited to expose vulnerabilities if not managed appropriately.  

The company stated that the flaw, which affected Google Chrome, could have been exploited by hacking and building a false website. This site promoted a newly launched service related to crypto wallets. A website that prompts people to download "recovery" keys might then appear to deceive them into creating a new wallet.   
Read more »
User Privacy
Botnet Crypto Wallet Cyber Attacks Cyble DDOS Attacks Discord Info Stealer Telegram Tokens User Privacy

Telegram is Selling the Eternity Malware Kit, Which Offers Malicious Services 

 

Cybercriminals have recently used Telegram to offer malware and other dangerous tools as services. Researchers have discovered a deadly new malware subscription plan which can be used to facilitate a wide range of attacks. 

The "Eternity Project," a modular malware kit, has capabilities that allow buyers to steal passwords and credit card information, launch ransomware attacks and infiltrate victims with cryptomining software. Each component of the malware toolkit, such as an information stealer, a coin miner, a clipper, ransomware software, a worm spreader, and, finally, a DDoS (distributed denial of service) bot, can be purchased separately. 

The creators share the latest update, usage instructions, and debate feature proposals on a private Telegram channel with over 500 members. Buyers can apparently use the Telegram Bot to assemble the binary automatically after choosing its desired feature set and paying the equivalent amount in cryptocurrency. The malware module is the most premium at $490 per year. The info-stealer, which costs $260 per year, steals passwords, credit cards, bookmarks, tokens, cookies, and autofill data from over twenty different web browsers. 

The malware's versatility is also highlighted through a deep-dive investigation of the infostealer module. Researchers claim that this single tool may gather data from a wide range of apps, including web browsers and cryptocurrency wallets, as well as VPN clients, messaging apps, and more. 

The miner module is $90 a year and includes features such as task manager invisibility, auto-restart once killed, and startup launch persistence. The clipper is a $110 application that scans the clipboard for cryptocurrency wallet credentials and replaces them with wallets controlled by the user. The Eternity Worm is available for $390 from the developer, and it can propagate itself using USB drivers, lan shares, local files, cloud drives, Python projects, Discord accounts, and Telegram accounts.

The authors say it's FUD (completely undetectable), a claim supported by Virus Total data showing zero detections for the strain. Surprisingly, the ransomware module provides an option of setting a timer that, when reached, renders the files entirely unrecoverable. This adds to the victim's pressure to pay the ransom as soon as possible. 

Despite the wide range of hazards posed by Eternity Project malware, Cyble says there are a few precautions consumers can take. Maintaining regular data backups, keeping software up to date, and avoiding visiting untrustworthy websites and email attachments are recommended best practices.
Read more »
Subscribe to: Posts (Atom)