There is a new clipboard malware/stealer in the wild, known as
Prynt Stealer.
Prynt Stealer targets:
Document: pdf, rtf, doc, docx, xls, xlsx, ppt, pptx, indd, txt, json.
Database: db, db3, db4, kdb, kdbx, sql, sqlite, mdf, mdb, dsk, dbf, wallet, ini.
Source Code: c, cs, cpp, asm, sh, py, pyw, html, css, php, go, js, rb, pl, swift, java, kt, kts, ino.
Image: jpg, jpeg, png, bmp, psd, svg, ai.
Browsers:
Chromium-based browsers
MS Edge
Firefox-based browsers
Files targeted by malware for stealing data:
Web Data (for Autofill data)
Login Data (for Login Credentials)
History (for search history)
Cookies (for browser Cookies)
Messaging apps target
Discord
Pidgin
Telegram
Crypto wallets:Zcash, Armory, Bytecoin, Jaxx, Ethereum, AtomicWallet, Guarda, and Coinomi.
"Stealer queries registry for identifying the location of Blockchains such as Litecoin, Dash, and Bitcoin as shown in Figure below. It obtains the path from registry data “strDataDir” in the HKEY_CURRENT_USER\Software\Blockchain_name\ Blockchain_name-Qt registry key."![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2FOTkMz05.png&t=665&c=mUHK_XK9SbaSRw)
The attacks is very complicated as it uses a lot of Algo so that it won't be detected by AV softwares. Combinations of hard coded strings, AES256 and Rijndael encryption algorithm.
For a detailed technical explanation you can read it here:
https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/Let me just reiterated safety and security practices and precautions mentioned in the article:
- Avoid downloading pirated software from warez/torrent websites. The “Hack Tool” present on sites such as YouTube, torrent sites, etc., mainly contains such malware.
- Use strong passwords and enforce multi-factor authentication wherever possible.
- Turn on the automatic software update feature on your computer, mobile, and other connected devices.
- Use a reputed anti-virus and internet security software package on your connected devices, including PC, laptop, and mobile.
- Refrain from opening untrusted links and email attachments without first verifying their authenticity.