Moreover, cryptocurrency transactions are harder to track and undo.
“Cryptocurrencies are getting increasingly popular, with crypto exchange platform estimating that there are over 100 million people worldwide owning cryptocurrencies. BluStealer was also found to detect crypto addresses copied to the clipboard and replace them with the attacker’s predefined ones so that a transfer of crypto coins will arrive at the cybercriminal’s pocket instead of the legitimate holder. It can steal crypto wallet data such as private keys and credentials, which can result in the victim losing access to their wallet. Just like the DHL campaign, the General de Perfiles message includes the malicious BluStealer attachment.īluStealer is a keylogger, document uploader, and cryptocurrency stealer in one piece of malware. In the General de Perfiles example, those targeted receive information via email that they’ve overpaid invoices and that credit has been kept for them and will be billed against their next purchase. When the user tries to open the attachment, the installation of BluStealer is triggered. The recipient is then asked to fill in an attached form to reschedule the delivery of the package. The email informs the user that a package has been delivered to their head office due to the recipient’s unavailability. The DHL malspam campaign sends emails to victims that imitate the design of a genuine DHL message in order to lure the target into a false sense of security. The countries most impacted by the spread of the malspam campaign include Turkey, United States, Argentina, United Kingdom, Italy, Greece, Spain, Czech Republic, and Romania. Avast has tracked and blocked around 12,000 malicious emails distributing BluStealer. On September 10, Avast Threat Intelligence researchers discovered a spike in malspam campaign activity, abusing the names of shipping company DHL and Mexican metal production company General de Perfiles. Prague, Czech Republic, SeptemAvast (LSE:AVST), a global leader in digital security and privacy, has identified a malicious spam (malspam) campaign created to spread BluStealer, a type of malware designed to steal cryptocoins such as Bitcoin, Ethereum, Monero and Litecoin from popular wallets including ArmoryDB, Bytecoin, Jaxx Liberty, Exodus, Electrum, Atomic, Guarda, and Coinomi.