Click to Skip Ad
Closing in...

Beware: This dangerous new malware can steal your passwords and your cryptocurrency

Published May 5th, 2021 6:37PM EDT
Malware attack
Image: Minerva Studio/Adobe

If you buy through a BGR link, we may earn an affiliate commission, helping support our expert product labs.

Phishing attacks have spawned a slew of new malware threats in recent days, according to researchers who’ve identified a serious threat actor behind three new connected malware families — which have been labeled as Doubledrag, Doubledrop, and Doubleback — and another unrelated threat called Panda Stealer, which is a variant of a cryptocurrency stealer and is mostly being spread via global email spam.

Here’s a rundown on these new malware discoveries, including what researchers have found and the implications herein: Let’s start with a report from FireEye’s Mandiant cybersecurity team, which revealed malware strains that have never been seen before, with “professionally coded sophistication,” and that came in two waves of phishing attacks globally. These attacks hit some 50 organizations at the end of 2020, with the first wave reported on December 2 and the second wave coming between December 11 and December 18.

In both waves, the US was the main target. “In December 2020, Mandiant observed a widespread, global phishing campaign targeting numerous organizations across an array of industries,” the report notes. “Mandiant tracks this threat actor as UNC2529. Based on the considerable infrastructure employed, tailored phishing lures and the professionally coded sophistication of the malware, this threat actor appears experienced and well resourced.” These phishing campaigns were built around tricking recipients into opening emails containing inline links to malicious URLs and subsequently tricking the victim into downloading dangerous files.

Because of this, it’s worth reiterating that there’s never a bad time to brush up on the best practices governing how to protect yourself from phishing attacks and emails that, more than ever, can look like they’re the real thing — a package delivery update, or an alert from your bank or credit card company, for example. Here’s a helpful rundown of some strategies to follow to stay safe from phishing attacks.

Meantime, the Panda Stealer malware we mentioned above was revealed, thanks to researchers from Trend Micro, to be targeting people around the world, including in the US, Japan, Australia, and Germany. “Panda Stealer is deployed through spam emails posing as business quote requests to lure unwary victims into opening malicious Excel files,” the researchers explain.

This one sounds particularly nasty. “Once installed,” the researchers continue, “Panda Stealer can collect details like private keys and records of past transactions from its victim’s various digital currency wallets, including Dash, Bytecoin, Litecoin, and Ethereum. Not only does it target cryptocurrency wallets, it can steal credentials from other applications such as NordVPN, Telegram, Discord, and Steam.”

Furthermore, Panda Stealer is also able to take screenshots of the infected computer and to exfiltrate data from browsers like cookies, passwords, and cards. The full Trend Micro report is definitely worth a read.

Andy Meek Trending News Editor

Andy Meek is a reporter based in Memphis who has covered media, entertainment, and culture for over 20 years. His work has appeared in outlets including The Guardian, Forbes, and The Financial Times, and he’s written for BGR since 2015. Andy's coverage includes technology and entertainment, and he has a particular interest in all things streaming.

Over the years, he’s interviewed legendary figures in entertainment and tech that range from Stan Lee to John McAfee, Peter Thiel, and Reed Hastings.