VenomSoftX

This multi-stage stealer exhibits interesting hiding capabilities, concealed as small PowerShell scripts on a single line in the middle of otherwise innocent-looking large log files.

the malware tries to tamper with API requests the sites use for several actions like money withdrawal or sending security codes

This multi-stage stealer exhibits interesting hiding capabilities, concealed as small PowerShell scripts on a single line in the middle of otherwise innocent-looking large log files.

The extension disguises itself as various popular browser extensions to avoid user detection.

the malware tries to tamper with API requests the sites use for several actions like money withdrawal or sending security codes

The extension contains several files... webpack_content.js... monitors two input elements for content the user fills into websites... The only file that differs from the rest is webpack_block.js... It also modifies the getter of the password field to steal entered passwords.

It also modifies the getter of the password field to steal entered passwords. Once the request to the API endpoint is sent, the wallet address is extracted from the request, bundled with the password, and sent to the collector as a base64-encoded JSON via MQTT.

The malicious extension provides full access to every page the victim visits... steals credentials and clipboard content

the malware tries to tamper with API requests the sites use for several actions like money withdrawal or sending security codes

The extension contains several files... webpack_content.js... monitors two input elements for content the user fills into websites... The only file that differs from the rest is webpack_block.js... It also modifies the getter of the password field to steal entered passwords.

It also modifies the getter of the password field to steal entered passwords. Once the request to the API endpoint is sent, the wallet address is extracted from the request, bundled with the password, and sent to the collector as a base64-encoded JSON via MQTT.

ViperSoftX searches for cryptocurrencies stored locally on the infected device in cryptocurrency software and browser extensions, and monitors the clipboard for cryptocurrency wallet addresses to perform clipboard swapping.

The malicious extension provides full access to every page the victim visits, carries out man-in-the-browser attacks to perform cryptocurrency addresses swapping by tampering with API requests’ data on popular cryptocurrency exchanges.

The gathered data... is then concatenated together into a single string, encoded by base64, and sent to the hardcoded C&C server in the User-Agent HTTP header.

The first variant is a simple dropper that downloads another payload from a hardcoded C&C server and executes it.

The sent data are structured as follows... and sent to an MQTT broker

The gathered data, as well as the fingerprint, is then concatenated together into a single string, encoded by base64, and sent to the hardcoded C&C server in the User-Agent HTTP header.