Cryptocurrency stealer for Windows, macOS, and Linux went undetected for a year

Enlarge (credit: George / Getty Images)

Soaring cryptocurrency valuations have broken record after record over the past few years, turning people with once-modest holdings into overnight millionaires. One determined ring of criminals has tried to join the party using a wide-ranging operation that for the past 12 months has used a full-fledged marketing campaign to push custom-made malware written from scratch for Windows, macOS, and Linux devices.

The operation, which has been active since at least January 2020, has spared no effort in stealing the wallet addresses of unwitting cryptocurrency holders, according to a report published by security firm Intezer. The scheme includes three separate trojanized apps, each of which runs on Windows, macOS, and Linux. It also relies on a network of fake companies, websites, and social media profiles to win the confidence of potential victims.

Uncommonly stealthy

The apps pose as benign software that’s useful to cryptocurrency holders. Hidden inside is a remote access trojan that was written from scratch. Once an app is installed, ElectroRAT—as Intezer has dubbed the backdoor—then allows the crooks behind the operation to log keystrokes, take screenshots, upload, download, and install files, and execute commands on infected machines. In a testament to their stealth, the fake cryptocurrency apps went undetected by all major antivirus products.

Read 8 remaining paragraphs | Comments