{"id":126751,"date":"2025-04-09T02:17:54","date_gmt":"2025-04-09T02:17:54","guid":{"rendered":"http:\/\/cryptospotters.net\/?p=126751"},"modified":"2025-04-09T02:17:54","modified_gmt":"2025-04-09T02:17:54","slug":"hackers-hide-crypto-address-swapping-malware-in-microsoft-office-add-in-bundles","status":"publish","type":"post","link":"http:\/\/cryptospotters.net\/?p=126751","title":{"rendered":"Hackers hide crypto address-swapping malware in Microsoft Office add-in bundles"},"content":{"rendered":"

Source: Cointelegraph.com NewsMalicious actors are attempting to steal crypto with malware embedded in fake Microsoft Office extensions uploaded to the software hosting site SourceForge, according to cybersecurity firm Kaspersky.
\nOne of the malicious listings, called \u201cofficepackage,\u201d has real Microsoft Office add-ins but hides a malware called ClipBanker that replaces a copied crypto wallet address on a computer’s clipboard with the attacker’s address, Kaspersky\u2019s Anti-Malware Research Team said in an April 8 report.
\n\u201cUsers of crypto wallets typically copy addresses instead of typing them. If the device is infected with ClipBanker, the victim\u2019s money will end up somewhere entirely unexpected,\u201d the team said.
\nThe fake project\u2019s page on SourceForge mimics a legitimate developer tool page, showing the office add-ins and download buttons and can also appear in search results.
\nKaspersky said it found a crypto-stealing malware on the software hosting website SourceForge. Source: KasperskyKaspersky said another feature of the malware\u2019s infection chain involves sending infected device information such as IP addresses, country and usernames to the hackers through Telegram.
\nThe malware can also scan the infected system for signs it\u2019s already been installed previously or for antivirus software and delete itself.
\nAttackers could sell system access to others
\nKaspersky says some of the files in the bogus download are small, which raises \u201cred flags, as office applications are never that small, even when compressed.\u201d\u00a0
\nOther files are padded out with junk to convince users they are looking at a genuine software installer.
\nThe firm said attackers secure access to an infected system \u201cthrough multiple methods, including unconventional ones.\u201d
\n\u201cWhile the attack primarily targets cryptocurrency by deploying a miner and ClipBanker, the attackers could sell system access to more dangerous actors.\u201d\u00a0
\nThe interface is in Russian, which Kaspersky speculates could mean it targets Russian-speaking users.
\n\u201cOur telemetry indicates that 90% of potential victims are in Russia, where 4,604 users encountered the scheme between early January and late March,\u201d the report stated.
\nTo avoid falling victim, Kaspersky recommended only downloading software from trusted sources as pirated programs and alternative download options carry higher risks.
\nRelated: Hackers are selling counterfeit phones with crypto-stealing malware
\n\u201cDistributing malware disguised as pirated software is anything but new,\u201d the company said. \u201cAs users seek ways to download applications outside official sources, attackers offer their own. They keep looking for new ways to make their websites look legit.\u201d
\nOther firms have also been raising the alarm over new forms of malware targeting crypto users.\u00a0
\nThreat Fabric said in a March 28 report it found a new family of malware that can launch a fake overlay to trick Android users into providing their crypto seed phrases as it takes over the device.
\nMagazine: Bitcoin heading to $70K soon? Crypto baller funds SpaceX flight: Hodler\u2019s Digest, March 30 \u2013 April 5Read More<\/a><\/p>","protected":false},"excerpt":{"rendered":"

Source: Cointelegraph.com NewsMalicious actors are attempting to steal crypto with malware embedded in fake Microsoft Office extensions uploaded to the software hosting site SourceForge, according to cybersecurity firm Kaspersky. One… <\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[5],"tags":[],"_links":{"self":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts\/126751"}],"collection":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=126751"}],"version-history":[{"count":0,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=\/wp\/v2\/posts\/126751\/revisions"}],"wp:attachment":[{"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=126751"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=126751"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/cryptospotters.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=126751"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}