# Malware İlgili Makaleler

HTX Haber Merkezi, kripto endüstrisindeki piyasa trendleri, proje güncellemeleri, teknoloji gelişmeleri ve düzenleyici politikaları kapsayan "Malware" hakkında en son makaleleri ve derinlemesine analizleri sunmaktadır.

3 crypto attacks in 24 hours – From fake apps to a $14.2M SOL theft

The cryptocurrency space witnessed a high volume of attacks within 24 hours, highlighting several major security threats. First, fraudsters targeted SecondFi by creating fake browser extensions and apps to steal crypto; the company clarified its official channels and warned against unsolicited links. In a separate incident, a compromised early Solana whale wallet led to the theft of 180,900 SOL (worth $14.2 million), with the stolen funds being bridged to Ethereum and laundered via Tornado Cash. Finally, the jscrambler npm package suffered a supply chain attack where stolen credentials were used to publish malicious versions containing an information-stealing payload. These events underscore the prevalence of phishing, wallet exploits, and software supply chain vulnerabilities, emphasizing the need for vigilance, verifying official sources, and prompt software updates.

ambcrypto4 saat önce

3 crypto attacks in 24 hours – From fake apps to a $14.2M SOL theft

ambcrypto4 saat önce

Injective software package hit by malicious supply chain attack – Details

In a software supply chain attack, malicious actors compromised the Injective Labs TypeScript SDK (@injectivelabs/sdk-ts v1.20.21) by uploading a tainted version to the npm registry. The attackers gained access to a legitimate contributor's GitHub account to distribute malicious commits. The compromised package, disguised as a routine update, contained malware that activated only when developers used specific wallet generation functions, stealing private keys and mnemonic seed phrases. This breach impacted approximately 50,000 weekly downloads and spread through transitive dependencies in 17 other Injective packages. While a clean version (v1.20.23) was later released, the malicious package remained accessible. Affected users are advised to rotate credentials, create new wallets, and move their funds.

ambcrypto2 gün önce 15:03

Injective software package hit by malicious supply chain attack – Details

ambcrypto2 gün önce 15:03

Microsoft Identifies New Crypto Malware Targeting Wallet Addresses and Private Keys

In February 2026, Microsoft identified a new crypto clipper malware, dubbed Trojan/CryptoBandits.A, targeting Windows systems. The malware spreads via malicious shortcut files on USB drives and operates without a traditional installer or control servers by leveraging Windows Script Host and ActiveX to deploy a Tor proxy. Once active, it runs two modules: one for spreading and another for stealing information. The malware continuously monitors the clipboard for 12 or 24-word recovery phrases, Bitcoin/Ethereum private keys, and wallet addresses. When a user copies a wallet address, the malware silently swaps it with one controlled by attackers to divert funds. It also captures screenshots to gather information on wallet balances and user activity, sending data through Tor connections. Additional capabilities include remote code execution and persistence via scheduled tasks. Microsoft advises disabling auto-run features, restricting script interpreters and executable shortcuts from USB drives, and monitoring for suspicious activities like JavaScript execution, localhost:9050 proxy use, PowerShell screenshot capture, and clipboard monitoring.

TheNewsCrypto06/19 11:33

Microsoft Identifies New Crypto Malware Targeting Wallet Addresses and Private Keys

TheNewsCrypto06/19 11:33

Digital Nomad Remote Job Hunting Fraud Prevention Guide: Your Wallet Could Be Emptied Even Before the Interview Starts

Digital Nomad Remote Job Scam Prevention Guide: How to Avoid Getting Scammed Before the Interview Even Starts Remote job searching offers opportunities across cities and countries, but the lack of face-to-face interaction, use of stablecoins for salary, and reliance on private messages/emails for hiring make it harder to verify job legitimacy. Scammers are more prevalent online. This guide, based on real cases from the TT3Labs community, categorizes scams by what they target—your device/wallet, your money, or your identity—and offers practical avoidance strategies. Key Scam Types: 1. Targeting Device Control & Wallets: The most common. Red flags include requests to download unfamiliar meeting software, install "audio plugins," run commands, share screens, or connect your crypto wallet under the pretext of an interview or coding test. These actions can install malware to steal assets in seconds. 2. Targeting Your Money: Includes "pre-employment tests" that are actually刷单 schemes (requiring you to垫钱 with promises of returns), paid job placement guarantees, and training/onboarding loans. Legitimate companies do not charge candidates for hiring. 3. Targeting Your Identity: Requests for ID, passport, bank details, or手持自拍照 during the interview stage. Legitimate background checks typically occur after a formal offer. 4. Post-Hire Risks: Some real companies may exploit remote/cross-border arrangements to delay or withhold pay, especially the final month's salary. Common Red Flags: - Offers that seem "too good to be true" (high pay for low门槛, overly easy interviews). - Communication solely via private chat (e.g., Telegram) with refusal to use mainstream tools. - Rushing the process (sending meeting links at the last minute). - Offering upfront money before you start. - Inconsistent communication (e.g., awkward translation, mismatched accents). Self-Protection Strategies: - Verify through trusted channels: Use official job platforms, company websites, and official app downloads. - Research the HR contact's online presence. - Draw a clear line: Never install unknown software, run commands, pay fees, share wallet keys/私钥, or provide sensitive documents before formal入职. - Practice device isolation: Use a separate device,虚拟机, or sandbox for testing code or downloading suspicious files. If You've Been Compromised: 1. Immediately disconnect from the internet and shut down the infected device. 2. Use a clean device to move remaining assets to a new wallet address. 3. Change all important account passwords and enable two-factor authentication. 4. Document all evidence (chat logs, transaction records) for reporting and community awareness. 5. File a police report, understanding that recovery for跨境 scams can be difficult. Staying vigilant and following these guidelines can help digital nomads navigate remote job searches more safely.

marsbit06/10 09:21

Digital Nomad Remote Job Hunting Fraud Prevention Guide: Your Wallet Could Be Emptied Even Before the Interview Starts

marsbit06/10 09:21

Hackers Targeting Your Crypto Just Got An AI Upgrade — Google’s Report Is A Wake-Up Call

Google's Threat Intelligence Group warns that AI is now being weaponized by hackers at an industrial scale, posing a direct threat to cryptocurrency users. The report details a major escalation: threat actors, including state-linked groups, are using AI to develop zero-day exploits and polymorphic malware that evades detection. A key threat is PROMPTSPY, AI-enabled malware capable of autonomous, real-time attacks that can bypass standard two-factor authentication (2FA) by observing and manipulating live authentication sessions. The findings indicate that conventional security measures like 2FA are becoming insufficient against these AI-driven tools. The report recommends advanced protections like hardware security keys and multi-signature wallets as essential for crypto users facing this new threat landscape.

bitcoinist05/12 11:29

Hackers Targeting Your Crypto Just Got An AI Upgrade — Google’s Report Is A Wake-Up Call

bitcoinist05/12 11:29

Alert Across the Internet! Claude Code Source Code Leak Triggers "Secondary Disaster": Hackers Set GitHub Phishing Traps

A major security alert is circulating online following the accidental leak of Claude Code's source code by Anthropic. Hackers are exploiting the incident by creating fake GitHub repositories that distribute the information-stealing malware known as **Vidar**. Posing as a user named `idbzoomh`, the threat actor set up multiple repositories claiming to offer "unlocked enterprise features" from the leaked source code. These repositories are optimized for search engines to appear at the top of results for queries like “Claude Code leak,” increasing their reach. If a user downloads and executes the provided files, the Vidar malware is deployed. It is a sophisticated stealer designed to harvest sensitive data such as browser credentials, cryptocurrency wallets, and personal information. The attack also installs **GhostSocks**, a proxy tool that establishes hidden communication channels for remote control and data exfiltration. Security firm Zscaler notes that these malicious repositories update frequently, making it easier to bypass basic security scans. At least two similar repositories have been identified, suggesting the same attacker is testing different distribution methods. This incident highlights the compound risks in the AI era, where initial human error leads to secondary threats like social engineering. Developers are urged to obtain software only through official channels and avoid executing untrusted binaries.

marsbit04/03 01:06

Alert Across the Internet! Claude Code Source Code Leak Triggers "Secondary Disaster": Hackers Set GitHub Phishing Traps

marsbit04/03 01:06

A New Crypto Predator Emerges: Google Exposes ‘Ghostblade’

A new iOS malware called "Ghostblade," part of the DarkSword tool suite, has been exposed by Google Threat Intelligence. Designed to steal sensitive data from Apple devices, it targets cryptocurrency private keys, messages from iMessage, WhatsApp, and Telegram, as well as SIM details, location data, and media files. Ghostblade operates once, extracts information, and then deletes crash logs to avoid detection, leaving no persistent trace. This makes it particularly effective and hard to identify. The emergence of Ghostblade reflects a broader shift in cyberattacks toward individual crypto users rather than institutions. Although overall crypto hack losses dropped to around $50 million in February—down from $385 million the previous month—this decline is due to attackers shifting from code exploits to social engineering, phishing, and wallet poisoning schemes. The report underscores that high-value individual holders are increasingly targeted through deceptive websites and malware designed to operate quickly and discreetly.

bitcoinist03/21 20:02

A New Crypto Predator Emerges: Google Exposes ‘Ghostblade’

bitcoinist03/21 20:02

DOJ, Europol Freeze $3.5M In Crypto After Dismantling Global Proxy Fraud Network

US and European authorities dismantled SocksEscort, a global proxy service that used malware (AVrecon) to hijack over 369,000 devices in 163 countries, allowing criminals to hide their locations. The service, operating for years, generated at least $5.7 million from users who paid in cryptocurrency for anonymity. A coordinated law enforcement effort across multiple countries resulted in the seizure of 34 domains, takedown of servers, and freezing of $3.5 million in crypto. The network was linked to various crimes, including a $1 million cryptocurrency theft from a New York resident, bank fraud, and account takeovers.

bitcoinist03/14 22:02

DOJ, Europol Freeze $3.5M In Crypto After Dismantling Global Proxy Fraud Network

bitcoinist03/14 22:02

Web3 Security Stack Highlights Threat from Malicious NPM Package

Web3 Antivirus has identified a malicious NPM package disguised as an OpenClaw installer that deploys a Remote Access Trojan (RAT) targeting macOS users. The package, once installed, launches a fake CLI installer and prompts for the Keychain password. If provided, it steals sensitive data including seed phrases, browser credentials, wallet information, and SSH keys, sending them to the attacker’s server. Previously, Web3 Antivirus warned about legitimate Chrome extensions—QuickLens and ShotBird—that turned malicious after ownership transfers. These were used to inject malicious scripts and steal user data, including exchange session details and wallet credentials. Looking ahead to 2026, key Web3 security threats include smart contract exploits (due to logic errors and access control issues), phishing, social engineering, wallet drainers, and oracle manipulation. The primary goals of these attacks are data theft and fund draining.

TheNewsCrypto03/10 12:10

Web3 Security Stack Highlights Threat from Malicious NPM Package

TheNewsCrypto03/10 12:10

Google Uncovers iPhone Exploit Kit Targeting Crypto Wallets

Google's Threat Intelligence Group (GTIG) has uncovered a sophisticated iOS exploit kit, dubbed 'Coruna,' targeting iPhone users on iOS versions 13.0 to 17.2.1. The kit, which contains five complete exploit chains and approximately 23 exploits—including previously unknown ones—aims to steal cryptocurrency wallet seed phrases and sensitive financial data. First identified in February 2025, the kit has been linked to a suspected Russian espionage group targeting Ukrainians and later to fake Chinese crypto websites impersonating platforms like WEEX. When users visit these sites on vulnerable iOS devices, the kit deploys to harvest financial information, including seed phrases and credentials from apps like MetaMask and Uniswap. GTIG advises users to update to the latest iOS version or enable Lockdown Mode to mitigate such attacks.

TheNewsCrypto03/05 11:35

Google Uncovers iPhone Exploit Kit Targeting Crypto Wallets

TheNewsCrypto03/05 11:35

活动图片

Ethereumright-arrow

Market Analysisright-arrow