Cybersecurity experts have provided details on a malicious campaign targeting Ethereum XRP Solana.
Through compromised Node Package Manager (NPM), the attack targets Atomic wallets and Exodus wallets.
This wallet redirects the transactions into an address controlled by attackers without the owner of that wallet knowing.
Developers unknowingly install malicious npm packages into their projects. Researchers identified “pdf-to-office” As a package compromised that looks legitimate, but has hidden malicious code.
After installation, this package searches for any cryptocurrency wallets that are installed on the system and injects malicious codes to interfere with transactions.
‘Escalation in targeting’
“This latest campaign represents an escalation in the ongoing targeting of cryptocurrency users through software supply chain attacks,” In their report, researchers note that
It can also redirect Ethereum transactions.ETHThe Tron USDT and XRP are based on Tron (XRPSolana,SOL).
The ReversingLabs team identified the campaign using their analysis of suspicious packages. They also detected multiple indicators for malicious behavior, including URL connections that were suspicious and code patterns which matched known threats. They found that the multi-staged attack used advanced obfuscation methods to hide from detection.
Infection begins as soon as the malicious package launches its payload, which targets the wallet software. Code searches only for files located in specific paths.
After being located, malware then extracts an application archive. This is done by code which creates temporary directories. Once the application files are extracted, the malware code will be injected.
This malware alters the transaction handling code in order to substitute legitimate wallet addresses using base64 encoded ones with those controlled by an attacker.
When a user tries to send ETH via the code, it replaces the address of the receiver with the attacker’s decoded base64 address.
It can have a tragic impact on your wallet because the transactions look normal, while money is being sent by hackers.
The users will not be able to tell if their transaction has been compromised until after they have verified the blockchain and discovered that funds have gone to an unintended address.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: crypto.news
