A new ransomware family has been detected targeting the cryptocurrency community.
Cybersecurity researchers from Cyble recently discovered a strain they dubbed “AXLocker” which, aside from the usual encrypting of all files found on the endpoint, also ends up stealing Discord authentication tokens from the victims.
Discord is a communications platform that’s been around for quite some time, but has recently found new life in the cryptocurrency community. NFT projects, crypto tokens, and similar start-ups have chosen Discord as their communications platform of choice.
48-hour deadline
When a user logs into Discord, the platform installs a small token onto the computer, so that the user doesn’t need to authenticate every time they come back. Stealing this token would allow threat actors access to the victim’s account, even without knowing their passwords or other login details.
Other than that, AXLocker is nothing out of the ordinary. Once triggered, the malware (opens in new tab) targets specific file extensions and avoids some folders. It encrypts the files using the AES algorithm, but it doesn’t change their extensions – they remain with their normal filenames. It demands payment in cryptocurrency and gives users 48 hours to comply.
While the NFT and crypto community is used to cyberattacks and various criminals going after their digital belongings, stealing Discord tokens in the process makes this ransomware attack a lot more potent.
After all, should an owner, or developer, of such a project, have their Discord tokens taken, crooks could abuse their identity to launch fake campaigns and steal the community members’ NFTs and cryptocurrencies.
Still, according to BleepingComputer, the targets of AXLocker are first and foremost – consumers.
There was no word on AXLocker’s distribution method. Usually, threat actors would go for phishing emails, fake landing pages, and social engineering (fake LinkedIn identities, for example) to trick people into downloading and running the malware.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba