Threats Tagged 'wallet drainer'

A large-scale phishing operation has deployed 70 fraudulent websites impersonating legitimate cryptocurrency projects including xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, and Firelight. The fake sites closely replicate authentic platforms and lure visitors with offers to vote on rewards distribution dates in exchange for a 1.25x boost. Upon clicking the vote button, users encounter a wallet connection prompt that ultimately leads to malicious authorization requests designed to drain cryptocurrency tokens. The targeted projects were strategically selected based on recent token launches, airdrops, or active rewards programs, making the phishing attempts appear credible to community members. All malicious domains follow the pattern 'sitemu' followed by random characters on the .xyz domain, suggesting a coordinated campaign using shared infrastructure and phishing kits.

A campaign identified by the Socket Threat Research team involves 19 malicious browser extensions (18 for Chrome, 1 for Edge) active since February 2024. These extensions deliver a modular malware framework that communicates with command and control servers via WebSocket, strips Content Security Policy headers, and uses cross-site scripting (XSS) injection to execute payloads. The primary goal is to steal cryptocurrency wallet secrets and drain crypto assets, as well as harvest credentials. The threat actor either creates malicious extensions from scratch or compromises legitimate extensions with existing user bases, such as the 'Enable Right Click & Copy' extension with tens of thousands of users. The campaign, named 'Superior,' shows sophisticated and evolving capabilities targeting multiple cryptocurrency platforms and exchanges.