A Trojan that infected 28,000 users only stole $6,000 in cryptocurrency

ChainCatcher news, the cybersecurity company Doctor Web recently reported that it has detected malware disguised as legitimate software, such as office programs, game cheat programs, and online trading bots. This cryptocurrency hijacking and stealing software has infected over 28,000 users, primarily in Russia, but also including Belarus, Uzbekistan, Kazakhstan, Ukraine, Kyrgyzstan, and Turkey.

According to Doctor Web, the hackers have only obtained cryptocurrency worth about $6,000. However, it is unclear how much the creators of the malware have earned from cryptocurrency mining. The cybersecurity company stated that the sources of the malware include fraudulent GitHub pages and YouTube video descriptions with malicious links.

Once a device is infected, the secretly deployed software hijacks computing resources to mine cryptocurrency. The "Clipper" also monitors cryptocurrency wallet addresses copied to the device's clipboard, then the malware replaces it with an address controlled by the attacker - this is how they steal small amounts of cryptocurrency.