Cryptojacking and cryptocurrency theft malware infected tens of thousands of devices in recent months, but the attackers managed to steal only about $6,000.
On October 8, cybersecurity company Doctor Web reported that this malware disguised itself as legitimate programs, such as office applications, game cheats, and bots for online trading. The malicious program affected more than 28,000 users, primarily in Russia, as well as in Belarus, Uzbekistan, Kazakhstan, Ukraine, Kyrgyzstan, and Turkey.
Hackers used the "clipper" technique to replace wallet addresses copied by users with addresses controlled by attackers, which allowed them to steal cryptocurrency. However, the total damage was only about $6,000. It is unknown how much cryptocurrency the attackers may have mined.
The sources of malware distribution were fake pages on GitHub and video descriptions on YouTube with malicious links.
Advanced methods were used to bypass antivirus programs: malicious files were disguised as system components, and malicious scripts were run through legitimate software.
Doctor Web urges users to install programs only from official sources to avoid infection.
