This is a huge concern for electrum users. If someone were to open electrum after not using it a long time, aren't most ppl going to be tricked like this? I mean most ppl who are not tech savy would probably just update it right? More than 1/2 ppl would probably do this right without checking it out first? Thats what im thinking.
That's right. That's why so many people fell for this.
Also when you had that update message, did you click on the link and it updated? Thus it opened your chrome browser? Or you had to copy and paste it to chrome to download it? Also you can reject the update right? If you reject it, how do you do it? Can you ignore it? Or is there an X to click to close that message?
All this exploit did was show a fake update message. You had to open your browser, go to the URL in the message, download, and then run the executable to get phished. It never downloaded automatically or did anything else.
You could have just ignored the message and moved on. Obviously, they now stop appearing if you update your Electrum (which fixed the exploit), but again, all it did was show a message (which could easily be closed, ignored). That's why it was 80% a social engineering attack.
