HACKERS ARE USING FAKE GITHUB PROJECTS TO STEAL CRYPTO, KASPERSKY WARNS
- In a recent report,
@Kaspersky highlighted the threat of hackers using fake GitHub projects to steal cryptocurrency.
- The research shows that hackers exploit GitHub's open-source nature by creating fake repositories under the alias "GitVenom." These fake projects often appear to be legitimate tools but are laced with malware designed to steal personal data, including crypto wallet information
Key Details:
- Kaspersky's analysis reveals that the fake projects include tools such as a Telegram bot purported to manage Bitcoin wallets and a tool for automating Instagram interactions.
- These seemingly innocent applications mask malicious intent, which becomes evident once downloaded.
- Once the malware is triggered on a victim’s device, it runs in the background to steal sensitive information like saved passwords, crypto wallet info, and browsing history.
- In addition, a clipboard hijacker is used to find any cryptocurrency wallet addresses and rewrite these with addresses belonging to the hacker.
$442K Stolen in Latest Heist:
- In November, one victim was ripped off a whopping 5 Bitcoins (approximately $442,000) after downloading a malicious project.
- Hackers have been using the deceptive software tactics for some time now, with more and more people caught in the scam.
- The campaign targets people worldwide. However, some specific countries, including Russia, Brazil, and Turkey, have been singled out as high-concentration markets for victims.
- The fact that this scheme has been working for two years shows that it is a very effective and persistent threat.
- Kaspersky recommends developers and users be very careful when downloading any projects from GitHub, especially those not verified.
[Image obtained from Kaspersky X account and AI]