.jpg)
.jpg)
.jpg)
A malicious extension for Chromium-based web browsers has been observed to be distributed via a long-standing Windows information stealer called ViperSoftX.
Czech-based cybersecurity company dubbed the rogue browser add-on VenomSoftX owing to its standalone features that enable it to access website visits, steal credentials and clipboard data, and even swap cryptocurrency addresses via an adversary-in-the-middle (AiTM) attack.
ViperSoftX, which first came to light in February 2020, was characterized by Fortinet as a JavaScript-based remote access trojan and cryptocurrency stealer. The malware’s use of a browser extension to advance its information-gathering goals was documented by Sophos threat analyst Colin Cowie earlier this year.
“This multi-stage stealer exhibits interesting hiding capabilities, concealed as small PowerShell scripts on a single line in the middle of otherwise innocent-looking large log files, among others,” Avast researcher Jan Rubín said in a technical write-up.
“ViperSoftX focuses on stealing cryptocurrencies, clipboard swapping, fingerprinting the infected machine, as well as downloading and executing arbitrary additional payloads, or executing commands.”
The distribution vector used to propagate ViperSoftX is typically achieved through cracked software for Adobe Illustrator and Microsoft Office that are hosted on file-sharing sites.
The downloaded executable file comes with a clean version of cracked software along with additional files that set up persistence on the host and harbor the ViperSoftX PowerShell script.
Newer variants of the malware are also capable of loading the VenomSoftX add-on, which is retrieved from a remote server, to Chromium-based browsers such as Google Chrome, Microsoft Edge, Opera, Brave, and Vivaldi.
This is achieved by searching for LNK files for the browser applications and modifying the shortcuts with a “–load-extension” command line switch that points to the path where the unpacked extension is stored.
“The extension tries to disguise itself as well known and common browser extensions such as Google Sheets,” Rubín explained. “In reality, the VenomSoftX is yet another information stealer deployed onto the unsuspecting victim with full access permissions to every website the user visits from the infected browser.”
It’s worth noting that the –load-extension tactic has also been put to use by another browser-based information stealer referred to as ChromeLoader (aka Choziosi Loader or ChromeBack).
VenomSoftX, like ViperSoftX, is also orchestrated to steal cryptocurrencies from its victims. But unlike the latter, which functions as a clipper to reroute fund transfers to an attacker-controlled wallet, VenomSoftX tampers with API requests to crypto exchanges to drain the digital assets.
Services targeted by the extension include Blockchain.com, Binance, Coinbase, Gate.io, and Kucoin.
The development marks a new level of escalation to traditional clipboard swapping, while also not raising any immediate suspicion as the wallet address is replaced at a much more fundamental level.
Avast said it has detected and blocked over 93,000 infections since the start of 2022, with a majority of the impacted users located in India, the U.S., Italy, Brazil, the U.K., Canada, France, Pakistan, and South Africa.
An analysis of the hard-coded wallet addresses in the samples reveals that the operation has netted its authors a sum total of about $130,421 as of November 8, 2022, in various cryptocurrencies. The collective monetary gain has since dropped to $104,500.
“Since the transactions on blockchains/ledgers are inherently irreversible, when the user checks the transaction history of payments afterward, it is already too late,” Rubín said.
Unique Visitors
[url=http://diflucantab.shop/]diflucan price canada[/url]
[url=http://acyclovira.com/]zovirax tablets over the counter australia[/url]
[url=http://fluoxetinetab.com/]prozac nz[/url]
[url=http://modafinilsec.com/]buy modafinil online india[/url]
[url=http://amoxil.sbs/]medication amoxicillin 500mg[/url]
[url=https://propeciatabs.online/]buy generic finasteride[/url]
[url=http://buyviagrapl.com/]buy generic viagra online pharmacy[/url]
[url=https://modafiniltab.net/]modafinil buy in canada[/url]
[url=http://pharmacynx.com/]online pharmacy products[/url]
[url=https://wellbutrin.sbs/]wellbutrin rx online[/url]
[url=https://onlinedrugstore.click/]best online pharmacy india[/url] [url=https://viagrabro.com/]generic sildenafil canada[/url] [url=https://wellbutrina.monster/]zyban uk prescription[/url] [url=https://drugstores.monster/]online pharmacy pain[/url] [url=https://sildenafiltabs.shop/]buy viagra without a prescription[/url]
[url=http://wellbutrina.monster/]150 mg bupropion[/url]
[url=https://xtadalafil.online/]price of cialis daily[/url]
[url=https://modafinilp.shop/]modafinil purchase india[/url]
[url=http://dexamethasonetab.com/]dexamethasone online[/url]
[url=https://buymodafinil.life/]modafinil no prescription[/url] [url=https://drugstores.monster/]happy family drugstore[/url] [url=https://onlinepharmacyd.quest/]best online pharmacy no prescription[/url] [url=https://accutanetabs.shop/]accutane 2009[/url]
[url=https://cipro.live/]ciprofloxacin generic cost[/url] [url=https://fluoxetinetab.com/]buy prozac online nz[/url] [url=https://phenergan.site/]cheap phenergan[/url]
[url=https://orlistat.cfd/]xenical price[/url] [url=https://buyallopurinol.life/]allopurinol 300 mg cost[/url] [url=https://elaviltabs.shop/]medicine amitriptyline 25mg[/url] [url=https://cymbaltatabs.monster/]cymbalta prices[/url] [url=https://propeciatabs.online/]finasteride cost[/url] [url=https://fluoxetinetab.com/]fluoxetine 20 mg capsule price[/url]
[url=https://furosemidetab.quest/]220 lasix[/url]
[url=http://buylevitra.monster/]where to buy levitra online no prescription[/url] [url=http://sildenafilxd.com/]where to buy cheap viagra pills[/url] [url=http://wellbutrintab.shop/]wellbutrin cost in canada[/url]
[url=https://ciprof.quest/]buy cheap cipro online[/url]
[url=https://malegratabs.quest/]malegra dxt 130 mg[/url]
[url=http://cipro.live/]can i order cipro online[/url]
[url=https://cephalexin.site/]keflex price without insurance[/url]
[url=http://accutanetabs.shop/]accutane 20 mg daily[/url] [url=http://modafinilp.shop/]can you buy modafinil in mexico[/url] [url=http://acyclovira.com/]zovirax tablets 200mg[/url] [url=http://valacyclovirvaltrex.online/]valtrex cheapest price[/url] [url=http://azithromycinc.online/]azithromycin tablets canada[/url]
[url=https://happypharmacy.quest/]online pharmacy price checker[/url]
[url=http://amoxil.sbs/]amoxicillin 400[/url]
[url=https://benicartab.shop/]benicar generic substitute[/url]
[url=http://acyclovira.com/]zovirax tablet 400 mg[/url] [url=http://buymodafinil.life/]modafinil 600mg[/url] [url=http://modafinilp.shop/]order modafinil online uk[/url] [url=http://bactrimd.online/]bactrim buy[/url] [url=http://wellbutrina.monster/]bupropion xl 150 mg online[/url] [url=http://diclofenactab.quest/]voltaren cream generic[/url] [url=http://cymbaltatab.com/]cymbalta buy online[/url] [url=http://worldpharmacy.monster/]world pharmacy viagra[/url]
[url=https://happyonlinedrugstore.monster/]online pharmacy no rx[/url]
[url=http://alevitra.com/]levitra for sale uk[/url] [url=http://buyvalacyclovironline.com/]how to get valtrex over the counter[/url] [url=http://diflucana.com/]diflucan 150 mg canada[/url] [url=http://buyprednisone.monster/]prednisone 5093[/url] [url=http://ciprof.quest/]cipro south africa[/url] [url=http://fluoxetinetab.com/]fluoxetine 50 mg[/url] [url=http://ataraxtab.online/]100mg atarax[/url]
[url=https://cymbaltatabs.monster/]price of cymbalta 60 mg[/url]
[url=http://cialisgenerictadalafil.com/]cialis india pharmacy[/url]
[url=https://acyclovira.com/]zovirax buy[/url]
[url=http://neurontin.run/]medicine gabapentin 100mg[/url] [url=http://buylevitra.monster/]purchase levitra online canada[/url] [url=http://angpharm.com/]lasix 2.5 mg[/url] [url=http://fluoxetinetab.com/]order generic prozac without a prescription[/url]
[url=https://modafiniltab.net/]buy modafinil[/url]
[url=https://diflucana.com/]diflucan over the counter canada[/url]
[url=http://buyprednisone.monster/]10mg prednisone daily[/url]
[url=http://onlinedrugstore.click/]online pharmacy dubai[/url]
[url=https://buylexapro.monster/]lexapro 10mg tablets[/url]
[url=http://buyprozac.life/]prozac 80mg price[/url]
[url=https://lipitoratorvastatin.shop/]lipitor 20 mg canada[/url] [url=https://trustedpharmacy.quest/]online pharmacy pain[/url] [url=https://wellbutrintab.shop/]best generic wellbutrin 2018[/url] [url=https://neurontin.run/]gabapentin 600 mg price[/url] [url=https://trazodone.sbs/]cost of trazodone[/url] [url=https://propecia.click/]generic finpecia[/url] [url=https://antabuser.online/]antabuse pills[/url] [url=https://citalopram.site/]citalopram 80 mg[/url]
[url=https://wellbutrina.monster/]wellbutrin 150mg daily[/url] [url=https://trazodone.run/]trazodone australia[/url] [url=https://azithromycinc.online/]azithromycin 500 price[/url] [url=https://bactrim.fun/]order bactrim online[/url] [url=https://worldpharmacy.monster/]cheapest pharmacy for prescriptions[/url] [url=https://finpecia.fun/]generic propecia canada[/url] [url=https://modafinilp.shop/]buy provigil australia[/url]
[url=https://sildenafilxd.com/]cost of viagra[/url] [url=https://wellbutrintab.shop/]4 bupropion[/url] [url=https://buydrugstore.life/]happy family pharmacy order status[/url]
[url=http://antabuse.icu/]where to purchase antabuse[/url]
[url=https://elaviltabs.shop/]purchase of amitriptyline[/url]
[url=http://cialisgenerictadalafil.com/]cialis daily use 5 mg[/url]
[url=http://synthroidm.online/]synthroid brand cost[/url] [url=http://diclofenactab.quest/]voltaren where to purchase[/url] [url=http://modafiniltab.net/]modafinil 2018[/url] [url=http://buylexapro.monster/]generic lexapro[/url] [url=http://antabuse.icu/]otc disulfiram[/url] [url=http://cymbaltatab.com/]cymbalta 30 mg capsule[/url]
[url=http://buyviagrapl.com/]discount generic viagra canada[/url]
[url=http://citalopram.site/]celexa prescription[/url] [url=http://neurontin.run/]gabapentin generic price[/url] [url=http://amitriptylinetab.com/]elavil 50[/url] [url=http://buyprednisone.monster/]prednisone 5093[/url] [url=http://orlistat.cfd/]cheapest xenical uk[/url]
[url=https://worldpharmacyx.online/]trusted canadian pharmacy[/url]
[url=https://wellbutrin.sbs/]can you buy wellbutrin without a prescription[/url]
[url=http://trazodone.run/]desyrel medication[/url] [url=http://accutanex.online/]buy accutane 40 mg online[/url] [url=http://synthroid.sbs/]can you buy synthroid over the counter in mexico[/url] [url=http://buymodafinil.life/]how to purchase modafinil[/url] [url=http://buyprozac.life/]prozac brand price[/url] [url=http://cephalexin.site/]cephalexin 500mg capsules[/url] [url=http://azithromycina.net/]where to buy azithromycin over the counter in canada[/url]
[url=http://pharmacynx.com/]reputable overseas online pharmacies[/url]
[url=http://trazodone.sbs/]trazodone 50 mg generic[/url]
[url=http://buyretinoa.monster/]retino 0.25[/url]
[url=http://ciprofloxacin.fun/]how to get cipro without a prescription[/url]
[url=http://buytrazodone.life/]buy trazadone non generic on line without a prescription[/url]
[url=https://tadalafilx.monster/]cialis sales[/url] [url=https://pharmacynx.com/]legitimate online pharmacy usa[/url] [url=https://neurontin.run/]gabapentin 100mg capsules[/url]
Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?