俄罗斯黑客组织利用假冒MetaMask窃取百万美元加密货币

行业资讯1周前发布 web3tt

4 0 0

根据Koi Security最新研究，俄罗斯黑客组织”贪婪之熊”（GreedyBear）近期扩大攻击规模，使用150个”武器化火狐扩展程序”针对国际英语用户实施攻击。

这家美以合资安全公司在研究报告中披露，该组织通过150个武器化浏览器扩展、近500个恶意可执行文件及数十个钓鱼网站，在过去五周窃取超百万美元，”重新定义了加密货币盗窃的工业级规模”。

Koi首席技术官Idan Dardikman向Decrypt透露，火狐扩展攻击是”迄今最盈利的渠道”，仅此一项就贡献了百万美元赃款的大部分。

该组织通过伪造主流加密钱包扩展实施攻击，包括MetaMask、Exodus、Rabby Wallet和TronLink等知名产品。

黑客采用”扩展程序空心化”技术规避审核：先提交无害版本通过商店审核，再通过更新植入恶意代码。

配合大量虚假好评营造可信形象，诱导用户下载后窃取钱包凭证实施资产转移。

相比今年4-7月仅使用40个扩展的上一轮攻击，此次攻击规模呈指数级扩张。

第二攻击渠道涉及近500个Windows恶意程序，主要植入俄语盗版软件分发网站。这些程序包含凭证窃取器、勒索软件和木马病毒，显示其具备”根据需求调整策略的恶意软件分发管道”。

第三攻击向量为数十个钓鱼网站，伪装提供钱包服务、硬件设备或密钥恢复等业务，诱骗用户提交敏感信息。

值得注意的是，火狐扩展主要针对全球英语用户，而恶意程序更多瞄准俄语用户。

所有攻击域名均指向单一IP（185.208.156.66），该地址作为指挥中枢协调攻击并收集数据。Dardikman指出这种集中控制模式”更符合有组织网络犯罪特征，而非国家行为体”——后者通常采用分布式架构避免单点故障。

安全专家给出防护建议：

1. 仅安装信誉良好的开发者发布的扩展
2. 彻底避开盗版软件网站
3. 优先使用官方钱包客户端而非浏览器扩展
4. 大额资产建议采用硬件钱包，但务必通过官网购买（该组织已伪造硬件钱包销售页面）

每日加密简报

每日早间推送行业要闻、独家报道、播客及视频内容您的邮箱
立即订阅
立即订阅

行业资讯 # " he said # “Use hardware wallets for significant crypto holdings # ” explains Idan Dardikman # ” he added. “Likely Russian criminal groups operating for profit # ” using 150 weaponized Firefox extensions # a podcast # according to research from Koi Security. Publishing the results of its research in a blog # adding that users should always avoid pirated software sites. He also recommended using only official wallet software # although he advised moving away from software wallets if you’re a serious long-term investor. He said # and not browser extensions # before updating the apps with malicious code. They also post fake reviews of the extensions # but they have greatly ramped up the scale of their operations # capable of shifting tactics as needed.” The group has also created dozens of phishing websites # close to 500 malicious executables and “dozens” of phishing websites to steal over $1 million within the past five weeks. Speaking to Decrypt # Exodus # giving the false impression of trust and reliability. But once downloaded # hardware devices or wallet repair services. GreedyBear uses these websites to coax potential victims into entering personal data and wallet credentials # having “gained them most of the $1 million reported by itself.” This particular ploy involves creating fake versions of widely downloaded crypto wallets such as MetaMask # initially uploading non-malicious versions of the extensions # Koi also reports that “almost all” GreedyBear attack domains link back to a single IP address: 185.208.156.66. According to the report # Koi CTO Idan Dardikman said that the Firefox campaign is “by far” its most lucrative attack vector # plus original features # Rabby Wallet # ransomware software and trojans # speaking to Decrypt. Despite the variety of attack methods and of targets # such as digital wallets # the malicious extensions steal wallet credentials # The Russian hacking group GreedyBear has scaled up its operations in recent months # this address functions as a central hub for coordination and collection # U.S. and Israel-based Koi reported that the group has “redefined industrial-scale crypto theft # using 150 “weaponized Firefox extensions” to target international and English-speaking victims # videos and more. Your Email Get it! Get it!# which in turn are used to steal crypto Not only has GreedyBear been able to steal $1 million in just over a month using this method # which it has added to Russian websites that distribute pirated or repacked software. Such executables include credential stealers # which it then uses to steal funds. “It is worth mentioning that the Firefox campaign targeted more global/English-speaking victims # which Koi Security suggests indicates“a broad malware distribution pipeline # which pretend to offer legitimate crypto-related services # while the malicious executables targeted more Russian-speaking victims # with a previous campaign–active between April and July of this year–involving only 40 extensions. The group’s other primary attack method involves almost 500 malicious Windows executables

文章版权归作者所有，未经允许请勿转载。

“诡异局面”：SEC再度叫停持有比特币、以太坊及XRP的ETF转换申请

行业资讯 # SEC # XRP # 以太坊

4周前

《多元动态：比特币价格目标、Sharplink以太坊持仓与Vitalik提及动向》

行业资讯 # Layer 2 # Vitalik Buterin # 以太坊

1周前

Coinbase评级遭下调至”卖出”：散户热情降温 Compass Point看空

行业资讯 # Coinbase # 加密货币交易所 # 去中心化交易所

2周前

泰达公司报告第二季度盈利49亿美元，首席执行官暗示美国业务计划

行业资讯 # Tether # USDT # 加密货币

2周前

100