The attack specifically targets users of Atomic and Exodus wallets, hijacking transactions by injecting malicious code that redirects funds to attacker-controlled addresses. Once installed, the package examines the user’s system for installed cryptocurrency wallets and injects malicious code that can intercept and redirect transactions without the user’s knowledge. ReversingLabs researchers identified this campaign through their analysis of suspicious npm packages, noting multiple telltale signs of malicious behavior including suspicious URL connections and code patterns similar to previously identified malicious packages. Technical examination reveals a multi-stage attack that begins with package installation and proceeds through wallet identification, file extraction, code injection, and ultimately transaction hijacking. The malicious code first identifies the location of the wallet’s application files on the system and then targets the ASAR package format used by Electron-based applications. The malware modifies transaction handling code to replace legitimate wallet addresses with attacker-controlled ones using base64 encoding. The impact of this attack is potentially devastating for victims, as it can silently redirect cryptocurrency transactions to attacker-controlled wallets across multiple cryptocurrencies including Ethereum, Tron-based USDT, XRP, and Solana. The malware effectively hijacks transactions by replacing legitimate wallet addresses with encoded attacker addresses at the moment users attempt to send funds. The malware’s infection process begins when the malicious package executes its payload targeting installed wallet software. Cybersecurity researchers have uncovered a sophisticated malware campaign targeting cryptocurrency users through compromised npm packages. One such package identified in this campaign is “pdf-to-office,” which appears legitimate but contains hidden malicious functionality. Once located, the malware extracts the application archive, injects its malicious code, and then repacks the archive. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. After completing the infection, the malware communicates with a command-and-control server at 178.156.149.109, sending installation status information including the user’s home directory path.
This Cyber News was published on cybersecuritynews.com. Publication date: Sun, 13 Apr 2025 07:50:07 +0000