Новая вредоносная программа ModStealer атакует криптовалютные кошельки в разных операционных системах

cryptonews.ruPublished on 2025-09-12Last updated on 2025-09-13

Недавно обнаруженная вредоносная программа атакует пользователей криптовалют в системах macOS, Windows и Linux, представляя серьезную угрозу для кошельков и учетных данных.

Компания Mosyle, специализирующаяся на безопасности экосистемы Apple, первой обнаружила вредоносную программу. По данным исследователей, ModStealer оставалась полностью незамеченной основными антивирусными системами в течение почти месяца после загрузки на платформу VirusTotal. Этот сервис предназначен для анализа файлов на предмет вредоносного содержимого.

Специалисты Mosyle установили, что ModStealer предназначен для извлечения конфиденциальных данных с помощью предустановленного кода, который крадет закрытые ключи, сертификаты, файлы учетных данных и расширений браузерных кошельков. Исследователи обнаружили логику атаки на различные кошельки, включая расширения для браузеров Safari и Chromium.

Эксперты по безопасности отмечают, что вредоносная программа продолжает функционировать в macOS, регистрируясь в системе как фоновый агент. По данным Mosyle, сервер управления расположен в Финляндии, однако инфраструктура, вероятно, проходит через Германию, что позволяет операторам скрыть свое происхождение.

Распространение через поддельные вакансии

Сообщается, что вредоносное программное обеспечение распространяется через поддельные объявления о вакансиях — тактику, которая становится все более популярной для атак на разработчиков в сфере Web3. После установки вредоносного пакета ModStealer внедряется в систему и работает в фоновом режиме, захватывая данные из буфера обмена, делая скриншоты и выполняя удаленные команды.

Стивен Аджайи, технический руководитель отдела аудита DApp и искусственного интеллекта в Hacken, подтвердил, что вредоносные кампании по набору персонала с использованием мошеннических «тестовых заданий» в качестве механизма доставки становятся все более распространенными. Он призвал разработчиков принимать дополнительные меры предосторожности при запросах на загрузку файлов или прохождение оценок.

«Разработчики должны проверять легитимность рекрутеров и связанных доменов», — сказал Аджайи.

Подчеркивая важность разделения конфиденциальных активов, Аджайи посоветовал командам строго разделять среды разработки и хранилища кошельков.

«Требуйте, чтобы задания предоставлялись через публичные репозитории, и открывайте любую задачу исключительно в одноразовой виртуальной машине без кошельков, SSH-ключей или менеджеров паролей», — советует эксперт.

«Четкое разделение между средой разработки «dev box» и средой кошелька «wallet box» крайне важно», — подчеркнул он.

Практические рекомендации по безопасности

Аджайи также подчеркнул важность соблюдения базовой гигиены кошелька и защиты конечных точек для защиты от таких угроз, как Modstealer.

«Используйте аппаратные кошельки и всегда подтверждайте адреса транзакций на дисплее устройства, проверяя как минимум первые и последние шесть символов перед подтверждением», — сказал он.

Аджайи посоветовал пользователям использовать отдельный, заблокированный профиль браузера или отдельное устройство исключительно для работы с кошельком, взаимодействуя только с доверенными расширениями кошелька.

Для защиты аккаунта он рекомендовал офлайн-хранение сид-фраз, многофакторную аутентификацию и, по возможности, использование паролей FIDO2.

Related Reads

Programmers Worldwide Are Wasting Money on Anthropic! The Company Can't Stand It Anymore

Anthropic recently published guidelines to help developers using Claude Code reduce unnecessary token costs. The key recommendations include: 1) Clear (/clear) conversations after completing a task to avoid carrying irrelevant file reads and command outputs into the next task. 2) Set the model and reasoning effort level at the start of a session, as switching mid-session invalidates the prompt cache, requiring a full-price recalculation of the entire dialog history. 3) Attach files using @ references instead of typing paths manually to avoid extra tool calls and searches that bloat the context. 4) Add quiet flags to verbose commands (e.g., in CLAUDE.md) to minimize lengthy output in the dialog history. 5) Use /compact while the session cache is still warm (before breaks) to compress the dialog at one-tenth the cost. 6) Offload large-output tasks to a sub-agent, which runs in an isolated context and only returns conclusions, preventing intermediate outputs from polluting the main dialog. The article explains token pricing: input tokens (prefill) are processed in parallel, while output tokens (decode) are generated serially, making output tokens five times more expensive. Caching is crucial for savings—if a request's prefix (system prompt, CLAUDE.md, dialog history) matches the previous one byte-for-byte, reading it costs only 10% of the standard input price. However, cache invalidation occurs when changing models, effort levels, fast mode, compressing dialogs, after cache expiration, or when resuming old sessions. Dialog history also grows quadratically (O(n²)) as file contents and command outputs accumulate, increasing costs per round. Proactive context management—like isolating noisy tasks, using /rewind to trim unproductive turns, and task-based session clearing—is becoming an essential skill for cost-effective AI-assisted development.

marsbit1h ago

Programmers Worldwide Are Wasting Money on Anthropic! The Company Can't Stand It Anymore

marsbit1h ago

Pax Silica vs. WAICO: The US Wants to Prohibit Europe from Using Chinese Artificial Intelligence

The United States is preparing to demand that European and other partners abandon Chinese artificial intelligence initiatives, threatening exclusion from the American-led "Pax Silica" coalition, according to a leaked U.S. State Department document. This ultimatum forces signatories of the "AI Opportunity Statement" to choose between the Western technological ecosystem and alternative frameworks, with China not explicitly named but clearly targeted. Pax Silica is a U.S. strategy for AI and semiconductor hegemony, launched in late 2025. Its European presence expanded significantly in mid-2026. Concurrently, China, Russia, and 27 other nations established the World AI Cooperation Organization (WAICO) in July 2026 as an independent intergovernmental platform promoting AI governance based on UN principles. This situation creates a difficult choice, especially for European nations balancing strategic autonomy with dependence on U.S. tech and security. It also pressures Global South countries with pragmatic ties to both Washington and Beijing. The formation of competing blocks risks fragmenting the global tech landscape, forcing companies to split supply chains, increasing costs, and potentially leading to incompatible standards and protocols. The era of open globalization in AI may be ending, replaced by geopolitical confrontation where technological sovereignty trumps economic efficiency. The decisions made will shape the global digital economy for decades.

cryptonews.ru3h ago

Pax Silica vs. WAICO: The US Wants to Prohibit Europe from Using Chinese Artificial Intelligence

cryptonews.ru3h ago

Paul Tudor Jones' Bet on BlackRock's Bitcoin ETF Reaches $22.9 Million

Tudor Investment Corp, a macro hedge fund founded by Paul Tudor Jones, disclosed owning 688,529 shares of the BlackRock iShares Bitcoin Trust (IBIT) in its latest 13F filing. As of June 30, the stake was valued at $22.9 million, marking an 18.9% increase from the previous quarter. This positions Jones among traditional asset managers increasingly using spot Bitcoin ETFs for crypto exposure. With Tudor managing approximately $106 billion, the IBIT investment remains a small portion of its overall portfolio. A long-time Bitcoin advocate, Jones has consistently framed the asset as an inflation hedge rather than a speculative trade. His recent shift from Bitcoin futures to a direct, growing stake in a regulated spot ETF reflects both Bitcoin's mainstream adoption and his preference for traditional investment structures. IBIT, commanding about 49% of the U.S. spot Bitcoin ETF market, remains the dominant institutional vehicle. While not a major bet for a fund of Tudor's size, Jones's steady quarterly increases signal Bitcoin is evolving from a symbolic holding to a permanent portfolio fixture. The market will watch the next 13F filings in mid-November to gauge the sustainability of this trend and the conviction behind his longstanding bullish stance.

cryptonews.ru5h ago

Paul Tudor Jones' Bet on BlackRock's Bitcoin ETF Reaches $22.9 Million

cryptonews.ru5h ago

Robert Kiyosaki Shares His Mentor's Predictions About the Emergence of Bitcoin and AI

American entrepreneur and author of "Rich Dad Poor Dad," Robert Kiyosaki, discussed the influence of futurist R. Buckminster Fuller on his worldview, linking Fuller's past technological predictions to the emergence of Bitcoin and the development of artificial intelligence. In an X post, Kiyosaki also reflected on personal purpose, sharing his journey from the music business—where he worked with bands like The Police and Iron Maiden—to creating the "Cashflow" board game and writing his famous book. He described feeling an inner emptiness despite his success, a turning point that came after meeting Fuller, whom he studied with for three summers. Kiyosaki described Fuller as a "friendly genius" who foresaw world-changing developments like Bitcoin and AI. However, the core of his post focused on Fuller's philosophical impact, particularly a quote about belonging to the universe and finding purpose by dedicating one's life to the maximum benefit of others. The entrepreneur remains a vocal advocate for cryptocurrencies. He regularly advises buying Bitcoin during market panics, viewing it and assets like Ethereum, gold, and silver as hedges against traditional financial system failures. Kiyosaki has predicted a major market crash by 2026, seeing it as an opportunity for prepared investors, with long-term price targets including $750,000 for Bitcoin and $95,000 for Ethereum.

cryptonews.ru5h ago

Robert Kiyosaki Shares His Mentor's Predictions About the Emergence of Bitcoin and AI

cryptonews.ru5h ago

Etherealize CEO Calls Wall Street's Private Blockchains a 'Race to the Bottom'

Etherealize co-founder and CEO Vivek Raman criticized Wall Street's growing interest in private, permissioned blockchains, calling them a "race to the bottom." In an interview with CoinDesk, Raman argued that consortium networks fragment liquidity and return the industry to the siloed systems that blockchain technology was meant to overcome. He stated that closed networks do not interoperate, undermining two key advantages of the technology: system compatibility and liquidity concentration. Etherealize promotes Ethereum as an open, foundational layer for institutional players. Raman insists that privacy and access restrictions should be built on top of public infrastructure—at the application or L2 level—rather than creating separate, closed networks. He compared Ethereum to HTTP as a base layer, with additional permissioned and private layers akin to HTTPS. Examples of this new wave of "closed" solutions mentioned include Canton Network from Digital Asset, Circle's Arc project, and Stripe's Tempo. Raman termed this trend "consortium chains 2.0," recalling earlier initiatives like the R3 interbank consortium and the Hyperledger corporate ecosystem from 2016 that failed to gain significant traction. He reiterated his firm belief that a global, open, permissionless infrastructure is necessary as a foundational base layer. Raman previously noted in June that traditional financial institutions had begun implementing Ethereum-based solutions into real business processes.

cryptonews.ru5h ago

Etherealize CEO Calls Wall Street's Private Blockchains a 'Race to the Bottom'

cryptonews.ru5h ago

Trading

Spot
活动图片