New Spyware Replaces Crypto Wallets on Clipboard via Telegram

Juniper Threat Labs, a threat intelligence portal at Juniper Networks (NYSE: JNPR), discovered a new Trojan-delivered malware implementing major global messaging app Telegram to exfiltrate stolen information, according to threat research released on Sept. 26.

Amerian Internet infrastructure firm Juniper Networks has found a new spyware that uses Telegram app to replace crypto addresses with its own.

Masad Clipper and Stealer

Reportedly circulating under the name “Masad Clipper and Stealer” on black market forums, the spyware is capable of stealing a broad list of browsing data, including usernames, passwords, credit card information.

Moreover, the malware also includes a function that replaces cryptocurrency wallets from the clipboards with the one by the attacker’s party. According to the report, the spyware’s clipping supports a number of major cryptos such as Bitcoin, Ether (ETH), XRP, Bitcoin Cash (BCH) and Litecoin (LTC), among others.

Ongoing threat signals

Specifically, the malware uses Telegram as a Command and Control (CnC) channel, which reportedly allows the malware some anonymity. This malware is written using Autoit scripts and then compiled into a Windows executable, according to the report. After being installed, Masad Stealer starts by collecting sensitive information from the system like crypto wallet addresses, credit card browser data, PC and system information.

According to Jupiter Threat Labs, Masad Stealer sends all collected information to a Telegram bot managed by the threat actor, which also sends commands to the spyware.

The security portal concluded that Masad Stealer is an active and ongoing threat Command and Control bots were still alive at the time of publication.

Meanwhile, Telegram released a wallet for its TON Blockchain’s native token Gram in the app’s alpha version for iOS on Sept. 26. On Sept. 24, Telegram announced a bug bounty competition within its new smart contract coding contest.

New Malware Swaps Out Crypto Wallet Addresses as You Type Them

A new bit of malware called Masad Stealer can replace wallet addresses as you type them thanks to malicious code injected into your browser. According to Juniper Networks, it also steals:

PC and system information
Credit Card Browser Data
Browser passwords
Installed software and processes
Desktop Files
Screenshot of Desktop
Browser cookies
Steam files
AutoFill browser fields
Discord and Telegram data
FileZilla files

The program dumps this information to the malware controller’s Telegram account, ensuring relative security for the data it steals. It can also clip and change monero, litecoin, zcash, dash and ethereum addresses automatically and uses special search functions to pinpoint these addresses on your clipboard. Once it swaps the addresses it can intercept crypto as its being sent to legitimate wallets.

The particular version of the malware Juniper studied sent crypto to this wallet which currently contains almost a one full bitcoin.

“Based on our telemetry, Masad Stealer’s main distribution vectors are masquerading as a legitimate tool or bundling themselves into third party tools”, wrote the research organization. “Threat actors achieve end user downloads by advertising in forums, on third party download sites or on file sharing sites.”

The software masquerades as useful-looking software like Tradebot_binance.exe, Galaxy Software Update.exe, and Fortniteaimbot  2019.exe. Once infected, the computer then begins communicating with the command and control Telegram channel and sends back private data.

The malware allegedly costs $40 on the dark web and is completely configurable and very dangerous, said Juniper.

“Juniper Threat Labs believes that Masad Stealer represents an active and ongoing threat.  Command and Control bots are still alive and responding as of this writing, and the malware appears to still be available for purchase on the black market”, wrote the researchers.

Spread the love
FacebookTwitterLinkedinRedditMixWhatsappWordPressTelegramVkontakte
Share

Recent Posts

Ethereum’s One Month Correlation with BTC Drops to 68% as $3k Beckons
  • Ethereum News 2

Ethereum’s One Month Correlation with BTC Drops to 68% as $3k Beckons

$3k Possible for Ethereum in the Month of May. Ethereum’s ongoing…

Ethereum 2.0 Deposit Contract Now Holds 4M ETH Worth $10.8B
  • Ethereum News 2

Ethereum 2.0 Deposit Contract Now Holds 4M ETH Worth $10.8B

Ethereum Aims for new ATHs as Options and Futures Expire…

Tesla sold 10 percent of its bitcoins. Cause of concern for cryptocurrency investors?
  • News coin 2

Tesla sold 10 percent of its bitcoins. Cause of concern for cryptocurrency investors?

Tesla released its first quarter 2021 earnings earlier this week.…

Gemini Exchange to Issue Its Own Credit Card for Cryptocurrency Cashbacks
  • News coin 2

Gemini Exchange to Issue Its Own Credit Card for Cryptocurrency Cashbacks

Users of the large cryptocurrency exchange Gemini will soon get…

Iranian government will use mined cryptocurrency to fight economic sanctions
  • News coin 2

Iranian government will use mined cryptocurrency to fight economic sanctions

Iran continues to explore the potential use of cryptocurrencies as…

Ethereum’s Recent High Fees Pushed More USDT to Tron
  • Ethereum 2019 News

Ethereum’s Recent High Fees Pushed More USDT to Tron

Tether’s Market Cap Hits $50 Billion. Mr. Ardoino’s comments were in…