Cybersecurity Alert: Malware Targets Crypto Wallets via Fake Microsoft Office Extensions

According to Cointelegraph, cybersecurity firm Kaspersky has identified a new threat targeting cryptocurrency users through malware embedded in fake Microsoft Office extensions uploaded to the software hosting site SourceForge. The malicious listing, named “officepackage,” includes genuine Microsoft Office add-ins but conceals a malware known as ClipBanker. This malware replaces a copied crypto wallet address on a computer's clipboard with the attacker's address, posing a significant risk to users who typically copy wallet addresses instead of typing them. If a device is infected with ClipBanker, the victim's funds could be redirected to an unexpected destination. Kaspersky's Anti-Malware Research Team highlighted that the fake project's page on SourceForge mimics a legitimate developer tool page, displaying office add-ins and download buttons, and can appear in search results. Another feature of the malware's infection chain involves transmitting infected device information, such as IP addresses, country, and usernames, to hackers via Telegram. The malware is also capable of scanning the infected system for signs of previous installations or antivirus software and deleting itself if detected. The cybersecurity firm noted that some files in the bogus download are suspiciously small, raising concerns as office applications are typically larger, even when compressed. Other files are padded with junk data to deceive users into believing they are installing genuine software. Attackers secure access to infected systems through various methods, including unconventional ones. While the primary target of the attack is cryptocurrency, deploying a miner and ClipBanker, attackers could potentially sell system access to more dangerous actors. The interface is in Russian, suggesting it may target Russian-speaking users, with telemetry indicating that 90% of potential victims are in Russia, where 4,604 users encountered the scheme between early January and late March. To mitigate the risk of falling victim to such attacks, Kaspersky advises downloading software only from trusted sources, as pirated programs and alternative download options carry higher risks. The company emphasized that distributing malware disguised as pirated software is not a new tactic, and attackers continually seek ways to make their websites appear legitimate. Other cybersecurity firms have also raised concerns about emerging forms of malware targeting crypto users. Threat Fabric reported a new family of malware capable of launching a fake overlay to deceive Android users into providing their crypto seed phrases, effectively taking control of the device.