According to reports in local media, the Chinese printer manufacturer Procolored spread malware that steals Bitcoin alongside its official drivers.
Chinese News outlet Landian News reported Procolored, a printer based in Shenzhen, has distributed Bitcoin-stealing material (BTCThe company reportedly used USB drivers to distribute malware-ridden drivers and uploaded the compromised software to cloud storage for global download. According to reports, the company used USB drivers for malware-infected drivers. It also uploaded compromised software onto cloud storage to be downloaded worldwide.
According to the report, 9.3 BTC totaling over $953,000.00 have been stolen. Slow Mist, a crypto tracking and compliance company, described the malware’s operation in an X article published on May 19. post:
“The official driver provided by this printer carries a backdoor program. It will hijack the wallet address in the user’s clipboard and replace it with the attacker’s address.”
Related: Massive supply chain attack targeting small number of crypto companies: Kaspersky
Malware in Procolored Drivers is flagged by YouTuber
Landian News recommends users who have downloaded Procolored Printer Drivers in the last six months, to “immediately perform a full system scan using antivirus software.” When in doubt, however, you should always opt for a system reset, due to the unpredictable nature of anti-virus software.
“Ideally, you should reinstall your operating system and thoroughly check old files.”
YouTubers were the first to report this issue. Cameron CowardWhile testing the Procolored UV printer, detected that malware was present in its drivers. The drive was flagged as having a trojan and a virus called Foxif by the software.
Related: Coinbase faces $400M bill after insider phishing attack
Security company confirms Crypto-stealing Malware
Procolored, when contacted by the media, denied these claims and said that the antivirus software had flagged the drivers as false positives. Coward turned away RedditThe issue was brought to the attention of G-Data by Mr..
G-Data’s investigation It was discovered that the majority of Procolored drivers are hosted by MEGA. The oldest uploads date back to October 2023. Analysis of those files confirmed that they were compromised by two distinct pieces of malware: backdoor Win32.Backdoor.XRedRAT.A and a crypto stealer designed to substitute addresses in the clipboard with those controlled by the attacker.
G-Data reached out to Procolored. According to the hardware maker, it removed the malicious drivers on its servers and then re-scanned the files. Procolored said that malware was introduced by a compromised supply chain. The malicious files were then uploaded to the internet.
Related: Crypto drainers as a service: What you need to know
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: cointelegraph.com
