You might save a few dollars downloading pirated software, but you could also end up losing a lot more in the process, as researchers have discovered a cryptocurrency-targeting infostealer lurking among the cracks.
Two separate cybersecurity firms – Flashpoint and Sekoia, uncovered a brand-new information-stealing malware dubbed “RisePro”.
RisePro is being distributed through websites hosting pirated software, cracks, loaders, and similar illegal content, and infects endpoints through the PrivateLoader pay-per-install (PPI) malware distribution service.
Stealing crypto account details
According to the researchers, RisePro carries many similarities to PrivateLoader, prompting the researchers to conclude that the malware distribution platform now has its own infostealer. What’s more, they discovered that it was most likely built on Vidar as a foundation, as it uses the same system of embedded DLL dependencies.
RisePro hunts for data from an extensive list of browsers, browser extensions, and cryptocurrency wallets, including Google Chrome, Firefox (and 30 other browsers), Authenticator, MetaMask, and Coinbase (and 26 other browser extensions). Furthermore, it steals data from Discord, battle.net, Authy Desktop, and can scan filesystem folders for valuable data, for example holding credit card information.
According to Flashpoint, criminals have already started selling RisePro logs with sensitive, personally identifiable data, on Russian dark web markets. Threat actors interested in buying either the logs, or the tool itself, can do so via Telegram, by interacting with the threat actors’ Telegram bot.
The researchers describe PrivateLoader as a pay-per-install malware distribution service, often posing as a software crack, or a keygen. Up until today, PrivateLoader only distributed RedLine Stealer or Raccoon, both of which are very popular infostealers in the cybercrime community.
The best way to protect against such threats is to refrain from downloading illegal content to begin with, and only download software from legitimate, verified sources. A strong antivirus solution is also advised.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba