Watch Out for More Advanced Malware Attacks

Lately, I've noticed that malware attempts here are getting way more advanced. Here are some methods I've come across. With the really smart attacks, just using common sense and running virus scans isn't enough to stay safe anymore. "latest wallet" or "custom wallet" or "faster miner". A newbie might ask for the newest wallet, or one without transaction fees, or the speediest miner. The attacker jumps in with a malicious link. Thankfully, this kind of scam usually gets caught pretty fast. Fake or copied ANN. An attacker sets up a new ANN thread and drops a malware link disguised as a wallet link (or they might start with a legit one and switch it to malware later). Changing links in quotes. The attacker takes a legit post that has a download link from the real dev (usually from the OP or an update) and swaps the link in that quote for a malware link. Hacked developer account. Sometimes, a developer's account gets hacked, and they post a "mandatory update." This is common with old or abandoned coins where the actual developer might not be around to catch the shady update. Packed or FUD executables. In many of these cases, the malware barely shows up on virus detection tools. This is because any script kiddie can shell out 30 bucks to get their malware crypted, making it practically invisible. Modified source with a backdoor. Recently, a user tipped me off about this. A newbie posed as someone trying to revive a coin and shared a new client along with its source code. But the source was messed with to include a backdoor.

Could you please post the coin's name and maybe others that you may have found ?

correct me if im wrong but maleware its generecly for executables in windows no? i mean the wallets are but its not kaspersky enough? if not why do we need to protect from the case of reteiving passorws from the users and other stuff from enven pen drives with wallets (including the common coins ones) like doge ltc btc and a few more.

I was checking some IRC bootstrap connections and found some additional info. Kinda looks ripe for the picking by a exploit. https://bitcointalk.org/index.php?topic=943519.new#new

I'm adding this to the list of possible scams: https://bitcointalk.org/index.php?topic=951827.0

This is found in the "Lucky7coin" source code, as linked above.

I'd like to add the bitcoinwisdomapp.com to the blacklist. It's a keylogger behind it.

Any thoughts ? EDIT SPR, ORB and at least one or two other coins are using this faucet/ block explorer site.

The multifaucet.tk wallet search would redirect you to a third-party ad network. Subsequently, the ad network would redirect you to the destination page -- which, in this case, is the result of the wallet search. I'm in California; the ad network being shown is adf.ly. Depending on your geographic location, you may get a different ad network. These third-party sites generate revenue for multifaucet upon every ad view. This is paid for by the ad publisher. However, multifaucet has no control of what ads are being shown. To maximize their profits, ad publishers may show ads that may lead to malware, which promises higher margins than conventional ads. In my case, I encountered the following page:

In my case, IE11 was completely locked up and I had to be fast with the "end process" clicks. I've never had my browser hijacked like this. That is unless we count AMD's user surveys they keep imposing on us after a driver install. lol

That's terrible. Anyone of you encountered the ransom cryptolocker? I heard about it not long ago. What is wrong with people?

Would running each wallet/miner in a different virtual machine with virtualbox prevent the effects of this kind of malware?

Yes, that would be one solution.

Wow.. this is like so pointless (not the thread, the 'hack') nowadays.. why not just place a keylogger in bios, then no matter what os folks use, you have 100% access to whatever machines are connected? Edit: Hint: Speedracer.

http://events.ccc.de/congress/2014/Fahrplan/system/attachments/2565/original/speed_racer_whitepaper.pdf

Thanks for being on top of this and keeping us informed, we do appreciate it!

Lol, this was just the beginning, If I can put a keylogger in my 64mb lappy bios.. I can do it with anyone.. Keep in mind this hack was released solely by them to LOCKDOWN your bios so you cant tamper with overclocking your machine.. the security they released after this demonstration is exactly how they get into your bios as only the NSA would LOVE. Edit: There is need for a new style of bios security, like anti virus, which, when your bios gets bigger, can load in bios FIRST, before bios is loaded.. it's not as hard as you think, but I'm not THAT good..

I just received something like this an hour ago.  I was surfing Ebay and laughed when I saw PimpCash.  Having to see if it was real, I went to pimpcash.com. Immediately something like what you showed came up.  However, for me, it pretended to be my service provider and gave me a number to call.  I confess I did try to call but the ring didn't sound right.  Sounded like an old telephone.  I hung up and rebooted my computer.  Things seem to be ok now.  I ran a quick scan and all seems to be okay.  Is there anything else I should do to check to see if my computer is okay?

Please check your "program files(x86) and the youruser/appdata/local/TEMP folders ! The ASN client is a remote desktop hack ! https://bitcointalk.org/index.php?topic=984878.msg10951987#msg10951987

Thanks this was very informative. I guess this forum is a big target for malware developers who want to steal easy crypto money.