MassJacker malware targets those looking for pirated software

Abstract image of cyber security in action.

OpenVPN-protokollet - därför är det så bra (Image credit: Shutterstock)

Cyberark finds website promoting pirated software distributing malware
One of the malware variants was a cryptojacker running more than 700,000 wallets
One of the wallets had 600 SOL in it

Cybersecurity researchers have recently uncovered MassJacker, a new malware variant aiming to steal cryptocurrency by replacing cryptocurrency addresses in people’s clipboards.

The team from Cyberark said it recently found a website - pesktop[dot]com, which claims to offer all sorts of pirated software, but in reality, it is distributing different versions of malware, including MassJacker.

It wasn’t said what the malware was posing as, but when victims install MassJacker, it works in the background, keeping track of the computer’s clipboard. When a person copies a cryptocurrency address, it will take note, and replace it with an address belonging to the attacker. That way, when the victim pastes the address, it is pasting a different one from the one they copied, and it is sending money to the attackers instead of whoever they wanted to send it to.

Hundreds of thousands of dollars

Cryptocurrency addresses are impossible to memorize by heart, as they are a string of 20+ seemingly random characters - which is why most people would keep them stored somewhere, and just copy and paste whenever they wanted to send funds. Cybercriminals see this as an opportunity to steal the money, and as far as MassJacker is concerned - it seems to be working.

Cyberark says MassJacker manages more than 770,000 unique crypto addresses. While most of them were empty, 423 had $95,300 in them, at the time the report had been written. “Adding the money that was previously held in those wallets but had already been transferred out brought the total up to around $336,700,” the researchers concluded.

However, that doesn’t mean that all of that money came from MassJacker. In fact, Cyberark believes that the opposite might actually be true, and that most funds came from “other malicious activities.” That being said, cryptocurrency worth about $87,000 (600 SOL) was found sitting in a single wallet that had 350 transactions.

Via The Hacker News

Docker instances targeted in major cryptojacking scam
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.