The ultimate goal is to trick developers into executing trojanized codebases that deploy malware designed to steal cryptocurrency wallet data, browser credentials, and sensitive system information. The malware’s browser module targets Chrome, Brave, and Edge profiles to extract encrypted credentials, leveraging OS-specific decryption methods—such as win32crypt on Windows or secretstorage on Linux—to decode sensitive data. Researchers identified two primary malware families in this campaign: BeaverTail, an infostealer and downloader, and InvisibleFerret, a modular backdoor enabling remote access and data exfiltration. Once executed, BeaverTail searches for browser extensions like MetaMask, Coinbase Wallet, and Phantom to exfiltrate cryptocurrency keys stored in id.json (Solana) or browser databases. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Recent updates to InvisibleFerret include FTP-based data exfiltration and integration with Telegram’s API for real-time credential theft, signaling evolving operational sophistication. Developers are advised to verify recruiter identities, avoid executing unsolicited projects, and monitor for anomalous network activity on ports 1224–1245. Posing as recruiters on platforms like LinkedIn, Upwork, and cryptocurrency-focused job boards, attackers lure victims with promising job opportunities or lucrative freelance projects. A North Korea-aligned cybercriminal campaign dubbed DeceptiveDevelopment has been targeting freelance software developers through fake job interviews since early 2024. These tools are remain hidden within software projects that victims are asked to review or modify as part of a fake hiring challenge. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 27 Feb 2025 09:25:19 +0000