Fake Cryptohopper Website Distributes Malware to Steal Crypto

Fraudsters have cloned the website of trading bot maker Cryptohopper to distribute malware to visitors’ computers, Bleeping Computer reported on June 5.

The fake website was first discovered by the malware researcher Fumik0_ who found out that it was injecting information-stealing Trojans, miners, and even clipboard hijackers.

Vidar behind a fake CryptoCurrency trading software with a fancy website (4962c0afb925d23013f6c80433f0a453), pushing also two Qulab Variants (Clipper only & Miner variant). An example among other about the aggressive focus on Cryptocurrencies Cryptocurrencies By using cryptography, virtual currencies, known as cryptocurrencies, are nearly counterfeit-proof digital currencies that are built on blockchain technology. Comprised of decentralized networks, blockchain technology is not overseen by a central authority.Therefore, cryptocurrencies function in a decentralized nature which theoretically makes them immune to government interference. The term, cryptocurrency derives from the origin of the encryption techniques that are employed to secure the netw By using cryptography, virtual currencies, known as cryptocurrencies, are nearly counterfeit-proof digital currencies that are built on blockchain technology. Comprised of decentralized networks, blockchain technology is not overseen by a central authority.Therefore, cryptocurrencies function in a decentralized nature which theoretically makes them immune to government interference. The term, cryptocurrency derives from the origin of the encryption techniques that are employed to secure the netw Read this Term these days. pic.twitter.com/TFrzabHHHa

— Fumik0_ (@fumik0_) June 5, 2019

Classic and sophisticated

When someone visits the scam website, it automatically downloads an executable file on the victim’s computer, and when it is installed, it infects the computer with the malware. The installation prompt even shows the logo of Cryptohopper to trick the victims.

Per the report, the installer installs a Trojan called Vidar. This steels information from the computer including browser cookies, browser history, browser payment information, saved login credentials, cryptocurrency wallets, text files, browser form autofill information, and Authy 2FA authenticator databases.

It also installs two more Qulab trojans for mining and clipboard hijacking. Both these Trojans are executed every minute to collect user data.

All the collected information is then uploaded to a remote server from where the attackers scrape the data.

The attackers are cautious enough to delete every piece of data from the victim's computer, leaving behind a directory of empty folders.

Moreover, to directly steal cryptocurrencies, the Trojans automatically replace the attacker's crypto wallet address on the clipboard when it detects the victim has typed in a cryptocurrency wallet address.

The report recorded a few addresses substituted on the victim's clipboard which consists of wallet addresses of Bitcoin Bitcoin While some may still be wondering what is Bitcoin, who created Bitcoin, or how does Bitcoin work, one thing is certain: Bitcoin has changed the world.No one can remain indifferent to this revolutionary, decentralized, digital asset nor to its blockchain technology.In fact, we’ve gone a long way ever since a Florida resident Laszlo Hanyecz made BTC’s first official commercial transaction with a real company by trading 10,000 Bitcoins for 2 pizzas at his local Papa John’s.One could now argue that While some may still be wondering what is Bitcoin, who created Bitcoin, or how does Bitcoin work, one thing is certain: Bitcoin has changed the world.No one can remain indifferent to this revolutionary, decentralized, digital asset nor to its blockchain technology.In fact, we’ve gone a long way ever since a Florida resident Laszlo Hanyecz made BTC’s first official commercial transaction with a real company by trading 10,000 Bitcoins for 2 pizzas at his local Papa John’s.One could now argue that Read this Term, Ethereum, Bitcoin Cash, DOGE, Dash, Litecoin, Zcash, Bitcoin Gold, QTUM, and Ripple.

The address associated with Bitcoin holds around 33 BTC worth $253,238 at current market rate. However, it is not confirmed that the coins were collected from scamming users.

The rise of malware

Crypto platforms and users are very lucrative targets for cyber scammers to attack with malware. Last month, Finance Magnates reported that the developers of notorious crypto jacking malware Shellbot updated it to not only mine crypto remotely but also to shut down host’s ongoing mining activities to utilize more processing power.

Another Trojan was discovered earlier this year, which was targeting Android devices to steal cryptocurrencies and fiats.