Re:A new cryptojacking tactic involving Wikipedia and downlo...
by themodelplumber on Wednesday January 16, 2019 @12:02AM
(#18918364)
So far I've got:
Download a movie --> Magic Happens --> Powershell --> Firefox compromised! --> We infected your torrents! --> Ah, found your crypto. --> Your address is now replaced with my wallet!! Ha ha!
Re:A new cryptojacking tactic involving Wikipedia and downlo...
by Dylan16807 on Wednesday January 16, 2019 @01:51AM
(#18918789)
Based on the tweets, step two is that the "movie" is actually a shortcut file. The shortcut runs powershell with a short obfuscated command that downloads the malware payload. Then it does a variety of normal malware stuff.
> The malware launches a Powershell command, which then inserts malicious code into the Firefox browser. The attack is designed to infect movie torrent files and is also meant to infect Windows computers in particular. The point of the attack is to phish for any Bitcoin or Ethereum addresses that the user might have. It’s an advanced virus as it then actually aims to replace these victims addresses with the hacker’s wallet.
Not sure where torrent come into this at all, for example