Reports said that a new strain of crypto-malware is being spread via YouTube, tricking users to download software that’s designed to steal data from 30 crypto wallets and crypto-browser extensions.
It has been reported that cyber intelligence company Cyble in a June 30 blog post said it had been tracking the malware known as PennyWise, likely named after the monster in Stephen King’s horror novel It, since it was first identified in May.
Cyble stated:
“Our investigation indicates that the stealer is an emerging threat. In its current iteration, this stealer can target over 30 browsers and cryptocurrency applications such as cold crypto wallets, crypto-browser extensions, etc.”
However, data stolen from the victim’s system comes in the form of Chromium and Mozilla browser information, including cryptocurrency extension data and login data. It can also take screenshots and steal sessions of chat applications such as Discord and Telegram.
The report said that the malware also targets cold crypto-wallets such as Armory, Bytecoin, Jaxx, Exodus, Electrum, Atomic Wallet, Guarda, and Coinomi, as well as wallets supporting Zcash (ZEC) and Ether (ETH) by looking for wallet files in the directory and sending a copy of the files to attackers, according to Cyble.
Likewise, the cybersecurity company noted that the malware is being spread on YouTube mining education videos purporting to be free Bitcoin mining software. The cybercriminals, or “Threat Actors,” upload videos instructing viewers to visit the link in the description and download the free software while also encouraging them also to disable their antivirus software which enables the malware to run successfully.
Cyble said the attacker had as many as 80 videos on their YouTube channel as of June 30. The channel identified has since been removed. Similar links to the malware remain on other smaller YouTube channels, with videos promising free nonfungible token (NFT) mining, cracks for paid software, free Spotify premium, game cheats, and mods.
Interestingly, the malware is designed to stop itself if it finds out the victim is based in Russia, Ukraine, Belarus, and Kazakhstan. Cyble also found that the malware converts the victim’s stolen time zone data to Moscow Standard Time (MSK) when the data is sent back to the attackers.
In February, malware named Mars Stealer was identified as targeting crypto wallets that work as Chromium browser extensions such as MetaMask, Binance Chain Wallet, or Coinbase Wallet.
Thus, Chainalysis warned in January that even “low-skilled cybercriminals” are now using malware to take funds from crypto HODlers, with cryptojacking accounting for 73% of the total value received by malware-related addresses between 2017 and 2021.
Source: Cointelegraph