Connect with us

Crypto

MassJacker malware uses 778,000 wallets to steal cryptocurrency

Published

on

MassJacker malware uses 778,000 wallets to steal cryptocurrency

A newly discovered clipboard hijacking operation dubbed ‘MassJacker’ uses at least 778,531 cryptocurrency wallet addresses to steal digital assets from compromised computers.

According to CyberArk, who discovered the MassJacker campaign, roughly 423 wallets linked to the operation contained $95,300 at the time of the analysis, but historical data suggests more significant transactions.

Also, there’s a single Solana wallet that the threat actors appear to use as a central money-receiving hub, which has amassed over $300,000 in transactions so far.

CyberArk suspects that the entire MassJacker operation is associated with a specific threat group, as file names downloaded from command and control servers and encryption keys used to decrypt the files were the same throughout the entire campaign.

However, the operation could still be following a malware-as-a-service model, where a central administrator sells access to various cybercriminals.

Advertisement
Transactions on the Solana wallet
Transactions on the Solana wallet
Source: CyberArk

CyberArk calls MassJacker a cryptojacking operation, though this term is more often associated with unauthorized cryptocurrency mining leveraging the victim’s processing/hardware resources.

In reality, MassJacker relies on clipboard hijacking malware (clippers), which is a type of malware that monitors Windows clipboard for copied cryptocurrency wallet addresses and replaces them with one under the attacker’s control.

By doing so, victims unknowingly send money to the attackers, though they meant to send it to someone else.

Clippers are simple but very effective tools that are particularly hard to detect due to their limited functionality and operational scope.

Technical details

MassJacker is distributed via pesktop[.]com, a site that hosts pirated software and malware.

Software installers downloaded from this site execute a cmd script that triggers a PowerShell script, which fetches an Amadey bot and two loader files (PackerE and PackerD1).

Advertisement

Amadey launches PackerE, which, in turn, decrypts and loads PackerD1 into memory.

PackerD1 features five embedded resources that enhance its evasion and anti-analysis performance, including Just-In-Time (JIT) hooking, metadata token mapping to obfuscate function calls, and a custom virtual machine for command interpretation instead of running regular .NET code.

PackerD1 decrypts and injects PackerD2, which eventually decompresses and extracts the final payload, MassJacker, and injects it into the legitimate Windows process ‘InstalUtil.exe.’

MassJacker infection chain
MassJacker infection chain
Source: CyberArk

MassJacker monitors the clipboard for cryptocurrency wallet addresses using regex patterns, and if a match is found, it replaces it with an attacker-controlled wallet address from an encrypted list.

CyberArk calls the cybersecurity research community to look closer into large cryptojacking operations like MassJacker, as despite the perceived low financial damages, they could reveal valuable identification information on many threat actors.

Red Report 2025

Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them.

Advertisement
Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Crypto

Crypto exchange Binance may have funded Iranian entities, reports say

Published

on

Crypto exchange Binance may have funded Iranian entities, reports say

Shortly after Donald Trump pardoned Changpeng Zhao, the Binance founder, last fall, company employees revealed the cryptocurrency exchange may have funded Iranian entities with billions of dollars, according to a report by the New York Times.

The discovery was made by a group of internal Binance investigators, who reportedly found that people in Iran had accessed more than 1,500 accounts on the crypto platform. Two of those accounts allegedly saw $1.7bn move to Iranian-backed groups that included Yemen’s Houthi militants throughout 2024 and 2025, according to the Wall Street Journal.

The company investigators say they reported those transactions to Binance’s executives, but then were reportedly disciplined. At least four of the employees were reportedly fired or suspended on allegations that included “violations of company protocol” in regards to the handling of client data.

In a statement to the Guardian, a Binance spokesperson said the company “did not violate sanctions laws in respect of the transactions described”. The spokesperson also denied that internal investigators were dismissed for raising the discovery. “No investigator was dismissed for raising compliance concerns or for reporting potential sanctions issues,” reads the statement.

Zhao founded Binance in 2017 and it went onto become the world’s largest cryptocurrency exchange. In 2023, Zhao pled guilty to money laundering and resigned from the company. He was sentenced to four months in prison. As part of the guilty plea, Zhao agreed to pay a $50m fine and was barred from any involvement in the business.

Advertisement

In October, Trump pardoned Zhao, downplaying the crimes. Trump’s family crypto business, World Liberty Financial, has worked with Binance and Zhao attended a conference at Mar-a-Lago earlier this month.

“They say what he did was not even a crime. It wasn’t a crime,” Trump told reporters in October. “That he was persecuted by the Biden administration and so I gave him a pardon at the request of a lot of very good people.”

Binance also pled guilty in 2023 and agreed to internal monitoring and a criminal fine of nearly $1.81bn, along with another $2.51bn order of forfeiture to settle three criminal charges. The company also vowed to go after bad actors who used its platform for financial transactions, including customers from Iran.

The Iranian transactions came to light inside the company before Trump’s pardon, according to the New York Times. The entities that reportedly received the funds include a chief foreign adversary that the Trump administration has reportedly been planning to strike.

The White House did not immediately return a request for comment.

Advertisement
Continue Reading

Crypto

Crypto Market Sell-Off: 1 High-Conviction Cryptocurrency to Buy and 1 to Avoid | The Motley Fool

Published

on

Crypto Market Sell-Off: 1 High-Conviction Cryptocurrency to Buy and 1 to Avoid | The Motley Fool

Keeping a steady head is crucial in turbulent market conditions.

The same lessons keep repeating themselves. Investors are being reminded of just how volatile the digital asset ecosystem can be. The market for cryptocurrencies reached a peak valuation of around $4.4 trillion in October last year. Today, the market cap sits at $2.4 trillion, a loss of 45% (as of Feb. 18).

The smartest investors are sharpening their focus, figuring out what portfolio moves to make amid the turmoil. Here’s one high-conviction crypto to buy and one that should be avoided like the plague.

Image source: Getty Images.

Buy the dominant cryptocurrency

Investors should consider buying Bitcoin (BTC 3.32%), the world’s leading digital asset that has pioneered the entire industry. Given that it represents 57% of the market, its price swings have an outsized impact. Bitcoin is 46% below its record.

Advertisement

Anyone who pays attention to history will quickly point out that these types of massive drops, which can be nerve-wracking when living through them, are extremely common. Bitcoin’s price has fallen more than 50% on numerous occasions. It’s hard to know exactly what’s causing the recent dip, with explanations ranging from large and early investors taking profits to investors worried about a hawkish Federal Reserve. There is no shortage of guesses.

What matters is that Bitcoin has a hard supply cap of 21 million units. It’s purely digital, transcends borders, is secure, and has ongoing adoption within the financial services industry and among regulators. In other words, the fundamentals are holding up.

Long-term investors should stay focused on these factors. In five or 10 years, Bitcoin’s price should be much higher.

Bitcoin Stock Quote

Today’s Change

(-3.32%) $-2247.81

Current Price

Advertisement

$65390.00

Avoid this meme token

On the other hand, investors shouldn’t touch Dogecoin with a 10-foot pole. What’s interesting is that this meme token has significantly outperformed Bitcoin over the past decade. However, it’s currently trading 86% off its peak from May 2021. And there are no signs of life that it can bounce back.

Advertisement

To its credit, Dogecoin was one of the earliest cryptocurrencies to hit the market. But it was created as nothing more than a joke. Its founders are no longer involved. And throughout its history, Dogecoin’s price has been supported by its community, which results in wild price movements based on hype. That community appears to be falling apart, given that Dogecoin’s price is so far below its record.

The market is realizing that Dogecoin has no real-world utility, other than being used by gamblers looking to score a quick profit. It’s not scarce, as the supply is constantly increasing. And it doesn’t have an expanding financial ecosystem being built around it. Keep this crypto out of your portfolio.

Continue Reading

Crypto

Cryptocurrency Stocks To Add to Your Watchlist

Published

on

Cryptocurrency Stocks To Add to Your Watchlist
Galaxy Digital, Bitfarms, HIVE Digital Technologies, Digi Power X, ZenaTech, Soluna, and Bitcoin Depot are the seven Cryptocurrency stocks to watch today, according to MarketBeat’s stock screener tool. Cryptocurrency stocks are shares of publicly traded companies whose business models or balance sh
Continue Reading

Trending