В магазине Google Play обнаружено поддельное приложение WalletConnect

investing.ru2024-09-30 tarihinde yayınlandı2024-09-30 tarihinde güncellendi

Исследователи Check Point (NASDAQ:CHKP) Research выяснили, что мошенники имитировали бренд и функциональность настоящего протокола с открытым исходным кодом WalletConnect. Когда пользователи подключали свои криптокошельки к мошенническому приложению, вредоносная программа запрашивала у них обширные разрешения, не вызывавшие подозрений из-за интерфейса сервиса, сходного с оригинальным протоколом. Получив необходимое разрешение от пользователей, злоумышленники с легкостью переводили криптовалюты из кошельков жертв на свои адреса.

Для повышения репутации и рейтинга своего приложения в поиске, злоумышленники использовали поддельные отзывы. Изначально приложение называлась Mestox Calculator, и оно уже несколько раз меняло названия. Чтобы оставаться незамеченным в течение нескольких месяцев в магазине Google (NASDAQ:GOOGL) Play, аферисты использовали передовые методы уклонения.

Приложение направляло пользователей в зависимости от IP-адреса и типа устройства, чтобы доступ к вредоносному бэкэнду мог осуществляться только по определенным сценариям. Для атаки и скрытого выполнения действий использовались смарт-контракты и глубинные ссылки. Это позволяло обходить как автоматические, так и ручные проверки безопасности Google Play, выяснили аналитики.

Фейковое приложение скачали более 10 000 пользователей, и как минимум 150 жертв лишились криптоактивов на общую сумму $70 000. Исследователи Check Point Research призвали пользователей быть бдительными, чтобы не стать жертвами криптомошенников.

Мошеннические приложения в магазине Google Play — не редкость. Несколько лет назад в нем появилось поддельное приложение Trezor Mobile Manager Wallet, где мошенники запрашивали кодовую фразу от криптокошелька. После скачивания подобного приложения, пользователь аппаратного кошелька Trezor лишился 17,1 BTC.

Читайте оригинальную статью на сайте Bits.media

İlgili Okumalar

Bridging Traditional Funds and DeFi: Who Will Capture the Next Decade's RWA Dividends?

Bridging Traditional Funds and DeFi: Who Will Capture the RWA Decade's Value? Tokenization of real-world assets (RWA) is merging the 24/7, permissionless world of DeFi with the time-bound, regulated world of traditional finance. While the complexity is immense, the infrastructure layer enabling this fusion holds significant value. The total value of on-chain tokenized real-world assets now exceeds $33 billion. While tokenized U.S. Treasuries dominate, their share has fallen from 55% to under 45% in a year as other assets like institutional and private credit grow. The key differentiator for on-chain assets is *composability*, allowing capital to be recycled across multiple yield-generating strategies simultaneously. However, tokenized funds remain regulated products with daily NAV updates, KYC requirements, and redemption windows. Bridging these to DeFi requires solving core conflicts: pricing assets between NAV updates, enforcing compliance without stifling DeFi activity, and maintaining accurate accounting during cross-chain transfers. Solutions like the Centrifuge V3 architecture, in collaboration with LayerZero, propose a hub-and-spoke model. A single authoritative hub chain manages NAV, compliance, and accounting, while LayerZero's messaging layer syncs this data to spokechains where tokens can be freely composed in DeFi. This creates a high-barrier, essential middleware layer. The major incentive for institutions is the potential for recursive yield strategies—for example, depositing into a tokenized Treasury fund, borrowing stablecoins against it, and redeploying those funds into another yield-bearing asset, amplifying returns. Yet, risks remain: mismatches between on-chain instant redemptions and off-chain fund limits (as seen in recent private credit fund runs), pricing arbitrage due to NAV lags, and cross-chain settlement failures. Infrastructure must solve these while maintaining regulatory compliance. Just as SWIFT and Visa captured immense value as financial plumbing, the entities that build the robust middleware connecting traditional finance and DeFi are positioned to capture the next decade's value in the RWA space.

Foresight News10 dk önce

Bridging Traditional Funds and DeFi: Who Will Capture the Next Decade's RWA Dividends?

Foresight News10 dk önce

CFTC Accuses North Carolina Firm of $14 Million Crypto and Futures Commodity Pool Fraud

The U.S. Commodity Futures Trading Commission (CFTC) has filed a civil action against Trevor Vernon and his firm, Argent Capital Management LLC, for allegedly operating an illegal commodity pool. The defendants are accused of fraudulently raising nearly $14 million from about 60 investors to trade cryptocurrencies, futures, and options. Regulators contend that Vernon misled investors by presenting the scheme as highly profitable through false performance updates, while in reality, the pool incurred consistent and significant losses, totaling at least $8.6 million. The CFTC also alleges that Vernon failed to register the commodity pool with the agency and made misleading statements about its regulatory status. The enforcement action, pending in a North Carolina federal court, seeks restitution for investors, monetary penalties, and permanent trading bans. This case underscores regulators' ongoing focus on policing unregistered investment schemes and ensuring accurate disclosures in crypto and derivatives markets.

TheNewsCrypto33 dk önce

CFTC Accuses North Carolina Firm of $14 Million Crypto and Futures Commodity Pool Fraud

TheNewsCrypto33 dk önce

AI Image Generation Without Training Speeds Up 1000%: Method: The Most Concise "Three-Stage Pipeline"

AI image generation is powerful but often feels slow for users. To address this without hardware dependencies, model fine-tuning, or dynamic runtime optimizations, researchers propose MrFlow (Multi-Resolution Flow Matching). This method uses a simple three-stage pipeline: first, generate a low-resolution structural draft; second, upscale it to high resolution in pixel space using a super-resolution model like Real-ESRGAN; third, add a small amount of noise and perform a single-step high-resolution refinement with the original model. This approach shifts most computations to the cheaper low-resolution stage, achieving up to 10.35x end-to-end speedup on models like Qwen-Image while maintaining image quality within ~1% of original outputs. Compared to other training-free acceleration methods, MrFlow offers better speed-quality trade-offs, works with various advanced models, and can be combined orthogonally with distillation techniques for further acceleration. The code and a ComfyUI plugin are openly available.

marsbit1 saat önce

AI Image Generation Without Training Speeds Up 1000%: Method: The Most Concise "Three-Stage Pipeline"

marsbit1 saat önce

Robinhood Chain's First Breakout Hit Is a Meme Cat: Retail Investors Dig Out CashCat's 'Original Name,' CEO Jumps on the Trend

Robinhood Chain launched its mainnet on July 1st, promoting tokenized U.S. stocks as its core feature. However, the first asset to gain significant traction was a meme token called CASHCAT, which surged over 1700% in 24 hours, reaching a market cap of $120 million. The token's narrative stems from Robinhood's early history: CEO Vlad Tenev revealed the company's initial working name was "CashCat." CASHCAT has no official ties to Robinhood and declares itself as "pure cat" with zero utility. Tenev added fuel by tweeting on July 8th that the chain is "great for memes," which the community saw as implicit approval. The hype has attracted copycat tokens on other chains like Solana and impersonator accounts promoting scams. The article highlights the extreme volatility and risks associated with this new, illiquid meme token on a fledgling blockchain, cautioning investors to verify contracts and treat any investment as high-risk speculation.

marsbit1 saat önce

Robinhood Chain's First Breakout Hit Is a Meme Cat: Retail Investors Dig Out CashCat's 'Original Name,' CEO Jumps on the Trend

marsbit1 saat önce

Crypto Regulation Could Shift This Month as SEC Moves Ahead With Safe Harbor Proposal

The U.S. Securities and Exchange Commission (SEC) may release a key crypto rulemaking proposal, known as Regulation Crypto, as early as July. This marks a significant policy shift under Chair Paul Atkins, moving from enforcement actions toward formal rulemaking to provide regulatory clarity. The proposal is expected to create safe harbors and exemptions for certain activities like DeFi and tokenized securities, potentially benefiting startups valued under $5 million and allowing fundraising up to $75 million. It also outlines conditions for when a token would no longer be treated as a security. Concurrently, the fate of the broader CLARITY Act legislation remains uncertain; if it fails to pass by August 2026, the SEC's own rules could become the primary framework for the U.S. crypto market.

TheNewsCrypto1 saat önce

Crypto Regulation Could Shift This Month as SEC Moves Ahead With Safe Harbor Proposal

TheNewsCrypto1 saat önce

İşlemler

Spot