Kaspersky has recently warned about a sophisticated malware campaign targeting cryptocurrency users through fake Microsoft Office extensions.
The malware is embedded in fake Microsoft Office add-ins, specifically within a package called "officepackage," which is hosted on SourceForge.
The primary malicious component is the ClipBanker trojan, which replaces copied cryptocurrency wallet addresses on the clipboard with the attacker's own address. This means that if a user copies a wallet address to send cryptocurrency, the malware could silently redirect the funds to the attacker's wallet.
The fake add-ins are uploaded to SourceForge, a platform that hosts software projects. The listings mimic legitimate developer tools, complete with real-looking buttons and descriptions copied from genuine GitHub projects.
These fake listings are well-indexed by search engines, making them appear in search results and increasing their legitimacy in the eyes of potential victims.
The initial download files are suspiciously small (about 7 MB), raising red flags since genuine office applications are typically much larger even when compressed. However, the downloaded zip file can be inflated to over 700 MB with junk data to appear legitimate.
The malware can transmit infected device information, such as IP addresses and usernames, to hackers via Telegram. It can scan for antivirus software and delete itself if detected to avoid detection.
The interface is in Russian, suggesting it may primarily target Russian-speaking users. Telemetry data indicates that 90% of potential victims are in Russia.
Users are advised to only download software from official and trusted sources to avoid falling victim to such scams.
Always scan downloaded files with up-to-date antivirus tools before executing them.
It's me, @justmythoughts, an ordinary Hive user looking to make the most of the platform. I will appreciate your support. Follow me for more. Thanks, Gracias :)