Nearly 2,000 hacked WordPress websitesare now displaying fake NFT and discount pop-ups to trick visitors into linking wallets to Crypto drainers that automatically steal money.
See also: WP-Members Membership: Vulnerability puts WordPress sites at risk
Website security firm Sucuri revealed last month that hackers had compromised around 1,000 WordPress websites to promote Crypto drainers, which they promoted through malicious advertising and YouTube.
It is believed that the malicious actors, having not been successful with their initial campaign, began deploying news scripts on the compromised websites to turn visitors' web browsers into tools for brute-forcing administrator passwords on other websites.
These attacks involved a cluster of approximately 1,700 brute-forcing websites, including sites like the Ecuadorian Private Banks Association. The goal was to create a large enough group of sites that could eventually generate revenue in a more extensive campaign.
According to cybersecurity researcher MalwareHunterTeam, threat actors have now begun monetizing the pool of websites to display pop-ups promoting fake NFT offers and crypto.
While it is unknown how many compromised WordPress sites are currently displaying these Crypto drainers, over 2,000 compromised sites have loaded the malicious scripts in the last seven days. Not all of them are currently creating scams, but that could change at any time.
See also: LayerSlider: Critical vulnerability in WordPress plugin
Pop-ups lead to Crypto drainers
The malicious scripts are loaded from the dynamic-linx[.]com, which is the same URL that Sucuri saw last month.
This script will check for a specific cookie (“haw”) and if it is not present, it injects malicious scripts into the website. The malicious code randomly displays an advertising pop-up, urging victims to connect their wallets to obtain a promising NFT or receive a discount on the website.
When you click the connect button, the scripts will initially show native support for MetaMask, Safe Wallet, Coinbase, Ledger, and Trust Wallet wallets . However, they also support “ WalletConnect ,” which supports many more wallets, significantly expanding the targeting range.
Once a visitor connects the WordPress site to their wallets, the Crypto drainers will steal all the money and NFTs in the account and send them to the hackers. It should be noted that MetaMask will display a warning when visiting sites infected with these malicious scripts.
Crypto drainers have become a huge problem for the cryptocurrency community, with hackers compromising well-known X accounts and creating artificial intelligence videos and malicious ads to promote websites that use malicious scripts.
See also: Ultimate Member: Critical vulnerability in WordPress plugin
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
What are the most common ways to protect against Crypto Drainers?
One of the most common ways to protect yourself from Crypto Drainers, such as those discovered on WordPress sites, is to use strong and unique passwords for your digital wallets. It is also important to change your passwords regularly. Additionally, using different levels of authentication can help protect against Crypto Drainers. This can include two-factor authentication (2FA) or multi-factor authentication (MFA). Using up-to-date security software, such as antivirus and firewall, is another way to protect yourself from Crypto Drainers. Finally, education and awareness of the latest techniques and tactics used by Crypto Drainers are crucial. Knowing how they attack can help you avoid attacks.
Source: bleepingcomputer
