Crypto

New Realst macOS malware steals your cryptocurrency wallets

Published

1 year ago

July 25, 2023

New Realst macOS malware steals your cryptocurrency wallets

A new Mac malware named “Realst” is being used in a massive campaign targeting Apple computers, with some of its latest variants including support for macOS 14 Sonoma, which is still in development.

The malware, first discovered by security researcher iamdeadlyz, is distributed to both Windows and macOS users in the form of fake blockchain games using names such as Brawl Earth, WildWorld, Dawnland, Destruction, Evolion, Pearl, Olymp of Reptiles, and SaintLegend.

These games are promoted on social media, with the threat actors using direct messages to share access codes required to download the fake game client from associated websites.

Access codes allow the threat actors to vet those they wish to target and avoid security researchers who want to reveal malicious behavior.

In reality, the game installers infect devices with information-stealing malware, such as RedLine Stealer on Windows and Realst on macOS. This type of malware will steal data from the victim’s web browsers and cryptocurrency wallet apps and send them back to the threat actors.

**One of the fake games installing Realst**
*Source: iamdeadlyz.gitbook.io*

SentinelOne analyzed 59 Mach-O samples of the Realst malware found by iamdeadlyz, focusing on its macOS versions, and found several distinct differences.

This allowed the researchers to identify 16 variants of the macOS malware, a sign of active and rapid development.

The Realst Mac malware

When downloading the fake game from the threat actor’s site, they will be offered either Windows or macOS malware, depending on their OS.

The Windows malware is typically RedLine Stealer, but sometimes other malware like Raccoon Stealer and AsyncRAT.

For Mac users, the sites will distribute the Realst info-stealing malware, which targets Mac devices as PKG installers or DMG disk files containing the malicious Mach-O files but no real games or other decoy software.

**Files in the downloaded archive** *(SentinelOne)*

The “game.py” file is a cross-platform Firefox infostealer and “installer.py” is “chainbreaker,” an open-source macOS keychain database password, keys, and certificates extractor.

SentinelOne found that some samples are codesigned using valid (now revoked) Apple Developer IDs, or ad-hoc signatures, to bypass detection from security tools.

The variants

All 16 distinct Realst variants analyzed by SentinelOne are fairly similar in form and function, although they utilize different API call sets.

In all cases, the malware targets Firefox, Chrome, Opera, Brave, Vivaldi, and the Telegram app, but none of the analyzed Realst samples target Safari.

“Most variants attempt to grab the user’s password via osascript and AppleScript spoofing and perform rudimentary checking that the host device is not a virtual machine via sysctl -n hw.model,” explains SentinelOne in the report.

“Collected data is dropped in a folder simply named “data” [which] may appear in one of several locations depending on the version of the malware: in the user’s home folder, in the working directory of the malware, or in a folder named after the parent game.”

The 16 distinct variants are categorized into four main families based on their traits, namely A, B, C, and D.

Family A, which has the most samples in circulation, uses “AppleScript spoofing” to trick the victim into typing their admin password on a dialog box.

**Code to generate password-stealing dialog** *(SentinelOne)*

Family B is similar to A and also uses password spoofing but divides the relevant strings into smaller units to evade simple static detection.

Family C also has a reference to chainbreaker within the binary itself, which allows it to extract data from the system’s keychain database.

**Chainbreaker reference in the family C binary** *(SentinelOne)*

Finally, Family D uses the Terminal window to prompt the victim to enter their password, which is used to dump saved credentials stored in Keychain.

**Installing pycryptodome** *(SentinelOne)*

In some cases, Family D leverages the acquired password to gain admin privileges on the system and install the Python cryptography library “pycryptodome,” which is also used to dump credentials from the Keychain.

Roughly 30% of the samples from families A, B, and D contain strings that target the upcoming macOS 14 Sonoma.

**Sonoma references in the code** *(SentinelOne)*

The presence of those strings shows that the malware authors are already preparing for Apple’s forthcoming desktop OS release, ensuring that Realst will be compatible and working as expected.

MacOS users are advised to be cautious with blockchain games, as those distributing Realst use Discord channels and “verified” Twitter accounts to create a false image of legitimacy.

Furthermore, as these games specifically target cryptocurrency users, the main goal is likely to steal crypto wallets and the funds within them, leading to costly attacks.

Crypto

Streamlined Cryptocurrency-Focused Apps

Published

6 hours ago

January 15, 2025

Press Room

Blaqclouds, Inc. has introduced ShopwithCrypto.io, a Progressive Web App designed to enhance cryptocurrency usability in daily transactions. This app offers a streamlined, multi-device experience that supports over 250 cryptocurrencies across major blockchain networks like ETH, BNB, and MATIC.

Key features of ShopwithCrypto.io include offline functionality, QR code integration, and the ability to purchase gift cards from global merchants, all while ensuring security and transparency through the ZEUS Blockchain. The Progressive Web App’s lightweight design and compatibility with both Android and iOS platforms make it accessible without the need for app store downloads. By combining ease of use with robust security measures, it aims to bridge the gap between digital assets and real-world spending. Its integration with popular wallets like MetaMask allows users to manage their transactions seamlessly while maintaining control of private keys.

Image Credit: Blaqclouds, Inc.

Crypto

Delta police targeting cryptocurrency scams

Published

14 hours ago

January 15, 2025

Press Room

Delta police targeting cryptocurrency scams

DPD and blockchain analytics company Chainalysis co-hosted other law enforcement agencies and cryptocurrency exchanges for ‘Operation DeCloak’

A cryptocurrency fraud workshop co-hosted by the Delta Police Department last fall identified over 1,100 victims worldwide, including a ‘significant number’ in Canada.

On Sept. 16 and 17, 2024, the DPD and blockchain analytics company Chainalysis hosted “Operation DeCloak,” bringing together representatives from law enforcement agencies including the RCMP, Victoria Police Department, Vancouver Police Department, the BC Securities Commission, the BC Prosecution Service and the BC Financial Services Authority, as well as key stakeholders from cryptocurrency exchanges such as Shakepay and others.

The initiative was a localized “sprint” of Chainalysis’ “Operation Spincaster,” a series of public-private collaborations designed to disrupt and prevent cryptocurrency scams. Spincaster itself spun out from “Operation Disruption,” a collaboration between Chainalysis and the Calgary Police Service in March 2024.

“Leveraging the transparency of the blockchain, Chainalysis proactively identified thousands of compromised wallets. This actionable intelligence formed the basis of a series of operational sprints across six countries (U.S., U.K., Canada, Spain, Netherlands and Australia) with over 100 attendees, including 12 public sector agencies and 17 crypto exchanges,” the company said in a press release.

“Over 7,000 leads were disseminated during these sprints, relating to approximately US$162 million of losses. These leads were used to close accounts, seize funds and build intelligence to prevent future scams.”

During last fall’s Operation DeCloak, Chainalysis led training sessions in investigating leads, tracing stolen funds and identifying compromised wallets using the company’s proprietary “Crypto Investigations Solution.”

According to a DPD press release, 240 crypto addresses were closely examined, revealing an estimated collective loss of C$35 million.

SEE ALSO: Court rejects environmental challenge to massive Delta port expansion

The event also promoted proactive policing and disruption strategies aimed at combating fraud, with particular emphasis on a growing tactic known as “approval phishing” used by romance and investment scammers targeting cryptocurrency transactions.

The method involves scammers gaining their victim’s trust by promoting false investment opportunities with the promise of high returns, thereby convincing victims to unknowingly approve malicious blockchain transactions.

The initial transaction gives the scammer access to tokens in the victim’s digital wallet without the victim’s knowledge, resulting in unauthorized withdrawals.

Police say scammers typically connect with their victims through social media, or via apps or pop-up ads.

During Operation DeCloak, police say immediate steps were taken to notify identified victims of these scams.

“With the co-operation of the exchange companies, affected individuals were promptly contacted with the goal of preventing further harm,” the DPD said in its press release.

Since the workshop, the department has successfully deployed the techniques learned through Operation DeCloak.

“The technique was applied to a previous investigation which identified stolen cryptocurrency funds in a blacklisted address containing US$1.2 million. This address was in the process of being seized by an overseas police agency,” the department said.

Using the DeCloak techniques, the DPD’s Cybercrime Unit has identified an additional 70 transactions worth US$800,000 sent from Canadian exchanges. Investigators are identifying those victims and seizing the funds from the blacklisted address so they can be returned.

“This collaboration with Chainalysis and cryptocurrency exchanges is a testament to the DPD’s focus on innovation and commitment to community safety and well-being.”

SEE ALSO: Conservative candidate files court petition over Surrey ‘voting irregularities’

SEE ALSO: Good Samaritan saves 3 people in fiery single-car crash in Surrey

Crypto

Coinbase Investigates ‘Delayed Sends’ for XRP on Its Platform | PYMNTS.com

Published

23 hours ago

January 15, 2025

Press Room

Coinbase Investigates ‘Delayed Sends’ for XRP on Its Platform | PYMNTS.com

Cryptocurrency exchange Coinbase said Tuesday (Jan. 14) that it is investigating a problem with delayed sends of Ripple (XRP) on its platform.

“We are aware that some users may be experiencing delayed sends for Ripple (XRP),” Coinbase said in an incident report on its status page. “Buys, Sells and Fiat withdrawals/deposits are not affected. We are investigating this issue and will provide an update shortly.”

In an earlier, separate report on its status page, Coinbase said some users experienced delayed sends and receives for Stellar (XLM) on Friday (Jan. 10). That incident was resolved within 90 minutes.

On Thursday (Jan. 9), some users experienced latency or degraded performance with buys, sells, sends, Coinbase Onramp and Advanced Trade. That issue was resolved within two hours, according to the page.

In other, separate news about the company, it was reported Thursday (Jan. 9) that Coinbase told customers that it may have to share data demanded by the Commodity Futures Trading Commission (CFTC).

The regulator sent a subpoena to the firm that seeks information about Coinbase customers’ interactions with prediction market firm Polymarket, and Coinbase emailed some customers saying it may have to share that data with the CFTC.

“When we receive requests for information from a government, each request is carefully reviewed by a team of trained experts using established procedures to determine its legal sufficiency,” a Coinbase spokesperson told CoinDesk.

On Dec. 9, cryptocurrency payments solution firm Triple-A announced an integration with Coinbase that it said it designed to let Coinbase users make payments to select merchants in the Triple-A network.

“Triple-A’s integration with Coinbase Commerce will empower merchants to offer a Coinbase-specific payment option, enhancing the convenience for Coinbase users and allowing Coinbase to connect with a wider network of merchants, to drive the broader adoption of cryptocurrency payments,” the company said in a press release.

Coinbase upgraded its Coinbase One subscription program and launched a new tier called Coinbase One Premium on Dec. 4, saying that with these new offerings, “Coinbase One now truly benefits all types of traders.”

Coinbase One membership has reached 600,000 across 42 countries, the company added.