An extensive exploit kit found in a fake copy of a torrented movie falsifies search results and redirects crypto payments, security site Bleepingcomputer.com reports.
The exploit suite, found in a counterfeit copy of the film "The Girl in the Spider's Web" (which has a 40% rating on Rotten Tomatoes), targets only the Windows operating system. The exploit can only target quick clickers, as the malicious file is not even a media-playing file type, but a .LNK shortcut.
The file opens multiple attack vectors. One of them generates fake ads and search results on Google and Yandex, hijacking both Chrome and Firefox browsers to do its job and downloading the extensions it needs to function. It redirects side-by-side searches for products like “spyware” to custom, fake anti-spyware software that is actually even more malicious software.
The exploit specifically targets encryption, by scanning websites for crypto addresses and replacing them with the attackers' addresses. The user, likely not noticing anything wrong, would then simply copy the incorrect address into a transaction field. To protect themselves from these attacks, users should always double-check the addresses they are sending money.
CryptoGlobe recently reported on the continued vulnerability of South Korean exchanges, despite efforts by government security audits. Another report from ICORating, released just a week ago, claimed that only 16% of the top 135 cryptoasset exchanges ranked highly in security. The majority of exchanges, according to the report, have had significant security patches – including some major players like Binance.
The general trend in crypto security is that so-called “cryptojacking” – the hijacking of an unwitting user’s computer and using it to mine crypto (usually Monero) – is on the decline, while data theft targeting public and private organizations, also known as “ransomware” – is on the rise.
Businesses and other entities are often targeted by ransomware with the encryption of their vital data, with attackers demanding ransom payments for decryption keys.
