New virus & malware automatically empties crypto exchange accounts

[The Cryptovator]

You can read the full details here: "New Virus Automatically Empties Crypto Exchange Accounts" - this is the topic title used from that article.

However, we know that malware is quite dangerous for crypto users, mainly because they tend to visit various sites such as gambling and porn. It is easier to attack crypto users through porn sites. But it seems that this new malware is more dangerous than previous ones. It can obtain your two-factor authentication by tricking you, so be careful, guys.

It has been suggested for a long time not to store your crypto in an exchange. Instead, use a non-custodial wallet or a hardware wallet so that malware won't damage you when you are using a hardware wallet. Even a non-custodial software wallet isn't safe from malware if both are on the same device.

[1713998909]

1713998909

[1713998909]

1713998909

[Charles-Tim]

But what if the 2FA app is on another device? Will the malware still be able to steal the code? The code, is it the secret code or the OTP that the malware can reveal to hackers? If it is the secret code, that means the advice that you should use another device for 2FA is always valid, yes it is valid, but it is good to avoid malware generally.

However, we know that malware is quite dangerous for crypto users, mainly because they tend to visit various sites such as gambling and porn. It is easier to attack crypto users through porn sites. But it seems that this new malware is more dangerous than previous ones. It can obtain your two-factor authentication by tricking you, so be careful, guys.

I do not think is it visiting of gambling and porn sites that actually cause that, it is the visit of illicit gambling and porn sites that google and other search engines can popup, or that you saw through ads and link ads. Also in anything we visit, we should always avoid malware. Just commenting because in every aspect of life, there are legit sites, be it gambling, exchanges and the likes.

It has been suggested for a long time not to store your crypto in an exchange. Instead, use a non-custodial wallet or a hardware wallet so that malware won't damage you when you are using a hardware wallet. Even a non-custodial software wallet isn't safe from malware if both are on the same device.

Noncustodial wallet can be online, they are also not safe against malware. Also people that uses hardware wallet should still be very careful of malware. Also people that are even using a means of having cold storage wallet like paper wallet and wallet on an airgapped device should be very careful.

Another source of malware are downloading of torrent files.

[Upgrade00]

The virus comes from a browser extension, this is a common trick scammers use to gain access to our devices. When browsing on the internet we should adopt safety practices;
• Do not allow unverified extensions, if there's an alternative avoid them entirely,
• Do not click unverified links,
• Do not download random apps from appstores or PDF files which can contain malwares,
• Use an ad blocker to protect against pop ups.

As a crypto user the ultimate safety hack is keeping your stash off exchanges and permanently offline. This way they cannot be hacked.

[Davidvictorson]

The scary thing about this is that this virus is just a strian. That is, there are other malwares with similar capabilities as the Rilide  virus and they are for sale as web browser extensions. From the article the malware is designed to attack Chromium-based web browsers like Google Chrome,
Opera, Brave, Vivaldi,Yandex Browser therefore folks who use non-Chromium-based web browsers like - Mozilla Firefox, Safari, Microsoft Edge, Tor Browser, SeaMonkey, Pale Moon, Midori, Konqueror are off the hook on this one but must remain vigilant against phishing attacks and stay informed about the latest cybersecurity threats and safety practices some of which have been mentioned by Upgrade00.

[Maus0728]

So to sum it up., in order to avoid such malware, you would have to completely avoid using Google or any Chromium-based browser and instead use Firefox as well as becoming a minimalist with regards to installing extensions, except for uBlock Origin, of course.

Not only that, to achieve optimal security with such malwares, it would be beneficial for people to have a separate computer or laptop used solely for crypto purposes. I have my old laptop with Linux Mint installed, and it only contains the necessary applications for doing Bitcoin transactions - nothing else.

Furthermore, upon researching, it appears that the malware disables the Content Security Policy (CSP), which makes the system vulnerable to attacks.

Rilide’s background script attaches a listener to the tabs.onActivated and webRequest.onHeadersReceived events and removes the Content Security Policy (CSP) directive for all requests. This allows the extension to perform an XSS attack and load external resources that would otherwise be blocked by the CSP. The app script adds another listener to the DOMContentLoaded event and retrieves a list of targeted domains from the C2. If the current domain matches any of the listed targets, designated scripts are injected into the webpage.

Now If you're too paranoid about automatic withdrawals on crypto exchanges, we can add another security layer by "whitelisting" an address so that he exchange will only allow withdrawals to previously whitelisted addresses.

These are the only measure I could think to prevent something bad from happening, or else you'd become a crybaby losing your hard-earned money.

[vv181]

But what if the 2FA app is on another device? Will the malware still be able to steal the code? The code, is it the secret code or the OTP that the malware can reveal to hackers?

If the 2FA is on another uncompromised device, the malware won't be able to steal the code. What the malware could do is to forge a dialogs, so, the way the user can get deceived is by inputting their OTPs on the exchange because it pretends to be a device authorization request, while actually in the background, that particular OTP is used to make the withdrawal.

non-Chromium-based web browsers like - Microsoft Edge,

Microsoft Edge is a Chromium-based browser.

[Wakate]

This is one of the main reason why I limit myself from using desktop to access important information, although it's not that using a phone would prevent us from getting attacked I think we just have ti to be very careful to a safety level. This are happening and we should make sure that we learn from other people's mistakes. Using an exchange is good even though most of us here would never want to be sincere to themselves. We need to make sure we are a wallet where we store our coins and send them to an exchange if we want to trade them.

[erep]

This is one of the main reason why I limit myself from using desktop to access important information, although it's not that using a phone would prevent us from getting attacked I think we just have ti to be very careful to a safety level. This are happening and we should make sure that we learn from other people's mistakes. Using an exchange is good even though most of us here would never want to be sincere to themselves. We need to make sure we are a wallet where we store our coins and send them to an exchange if we want to trade them.

If we use the desktop to visit the official site and don't add bad extensions to the browser then it's fine you use the desktop for whatever purposes it takes, but make sure anti-virus security has been enabled on the desktop to detect viruses in realtime, my friend's desktop is recent it's having malware for copy address replacing automatically from address hacker, so i have helped to fix that problem and antivirus gave source address of virus folder which turned out to be due to installing unofficial application, so be careful installing unofficial application on your desktop.

[SeriouslyGiveaway]

Microsoft Edge is a Chromium-based browser.

If you don't want Chromium-based browsers, use Firefox, Tor browsers.

Overview on browsers. Which one should we use? Support free web while browsing.

[Mame89]

When browsing the internet this kind of thing I'm worried about, it's very important to protect our devices from virus threats and scams. As you mentioned being careful when visiting porn and gambling sites, we must also Avoid unverified browser extensions and avoid clicking on unverified links is a good way to prevent fraud and illegal access to our devices. Also, not downloading random apps or files that may contain malware and using an ad blocker can also help protect our devices from online virus and malware threats.

As a crypto user, it is very important to take strong security measures to protect our crypto holdings. Keeping our crypto deposits off exchanges and permanently offline is one of the best ways to protect our crypto from hacks and other cyber attacks. Additionally, using a secure wallet and taking additional security measures such as using 2FA can also help protect our crypto from security threats.

[lionheart78]

We can also use virtual systems in our regular browsing sessions.  It is easy to install virtual drives and create an artificial operating system in our main system.  This will somehow prevent attacks on the main system directly if we happen to mistakenly click unverified links and other possible malware injections into our main system.

This article[1] gives a list of precautions in preventing our pc and mobile system to be corrupted or infiltrated by malwares.

I will list them here directly so that anyone interested doesn't have to go out of the forum but if you wanted to read the details then you can open the link below.

Ways to secure our PC from hacking

Use a firewall. Installyantivirusysoftwareyyyyyyyyyyyyyyyyyyyyyyy Install an anti-spyware package Use complex passwords Keep your OS, apps and browser up-to-date Ignore spam

Back up your computer Use virtualization Secure your network Use two-factor authentication Use encryption

For mobile devices

• Turn off Bluetooth.
• Don’t use unsecured public Wi-Fi
• Get a security app
• Use a better passcode
• Switch off autocomplete
• Clear your browsing history

Aside from the given method of securing our pc and mobile data and information, nothing beats being vigilant and suspicious on every site we visit. I believe the kind of malware strain mentioned by @OP  can be prevented by setting up a virtual system for protecting our main system from being infected since it provides an artificial separate environment within the main system and can be easily installed and deleted anytime.



[1] https://www.businessnewsdaily.com/11213-secure-computer-from-hackers.html

[capedbaldy]

snip

Thank you for sharing a lot of knowledge to avoid viruses and malware, but for PC users should avoid installing unofficial applications because some components have been modified to embed viruses and malware files, so always be careful and improve security features, another important advice that don't connect the main wallet to any site for trading or other needs, always use another wallet option for wallet connection purposes to avoid hacking that can harm our wallet.

[Hyphen(-)]

The virus comes from a browser extension, this is a common trick scammers use to gain access to our devices. When browsing on the internet we should adopt safety practices;
• Do not allow unverified extensions, if there's an alternative avoid them entirely,
• Do not click unverified links,
• Do not download random apps from appstores or PDF files which can contain malwares,
• Use an ad blocker to protect against pop ups.

As a crypto user the ultimate safety hack is keeping your stash off exchanges and permanently offline. This way they cannot be hacked.

I do things like this, and it's possible that's why my system was recently infected with malware.

Malware is extremely dangerous and can destroy someone's cryptocurrency carrier with a single mistake. For example, if you copy an address to send your entire Bitcoin to and the malware virus changes the address and you don't notice it, your entire Bitcoin is gone.
It is always a good idea to double-check any address to which you are sending Bitcoin because malware can change it and replace it with another with nearly the same beginning and end of the address.

[boyptc]

The virus comes from a browser extension, this is a common trick scammers use to gain access to our devices. When browsing on the internet we should adopt safety practices;
• Do not allow unverified extensions, if there's an alternative avoid them entirely,
• Do not click unverified links,
• Do not download random apps from appstores or PDF files which can contain malwares,
• Use an ad blocker to protect against pop ups.

I think the shortcut on this one for those non-technical people is the first one and that's to not download any extension that they're unfamiliar with. And even they're familiar with what they're downloading, they need to look at it first and see if it's from the official service and company that they want to download.

I guess the most common thing on this imitation will be from Metamask users. It's a very popular browser extension and wallet and it has a lot of users and keeps on adding more.

As a crypto user the ultimate safety hack is keeping your stash off exchanges and permanently offline. This way they cannot be hacked.

I agree, but no matter how many times we remind everyone. It is a personal choice that they think is less of the hassle because they can trade on an instant without doing deposit/withdrawal waiting time.

[MainIbem]

Is  there any way our mobile device will be affected as well?
Since some users already said it will be affected through unverified extension, meaning it may likely affect smartphones because I am on the safer side using phone due some unforeseen treat and attack that may arise from desktop.

[Woodie]

With all these kind of malwares, I honestly think cryprocurrencies were mearnt for millennials that cant easily fall for such kind of tricks!!
And one take away from this ,popular means easy  target...and seeing that Rilide targets chromium based browser's we could be safer with the less popular browsers such as Firefox etc, but then again these google guys need to start a clean up on the chromium store and play store to reduce the damage,  hope not so many people have lost through  this.

And this malware is quite interesting, just an extension and its has the keys to your stash, thankfully 2fa device for me is never the PC.

[Ryker1]

Thank you for sharing this which now has a lot of questions in my mind and made me confused.
Is the 2FA verification will really be bypassed by this malware? the OTP code that sends to our mobile number and the email verification process. Perhaps --those accounts that don't have these extra security levels will be affected by the malware infection, I am right?
Perhaps, your computer must always have extra security level protection against this.
Use anti-virus and anti-malware software that is reputable software on your computer, and keep it up to date with the latest virus definitions and also use a firewall --it can help to prevent malware from accessing your computer by blocking unauthorized incoming and outgoing network traffic.

[Smartvirus]

However, we know that malware is quite dangerous for crypto users, mainly because they tend to visit various sites such as gambling and porn. It is easier to attack crypto users through porn sites. But it seems that this new malware is more dangerous than previous ones. It can obtain your two-factor authentication by tricking you, so be careful, guys.

It has been suggested for a long time not to store your crypto in an exchange.

How does it do that, trick you into getting or giving away your 2-FA.
Recall this is a step towards security and one could be at ease with it in place although, not so much as, your mails could be compromised at some points or end but, its still up to you and where you might have previously logged in.

True enough, exchanges are no wallets and as such, users need to be mindful of what they let stay on exchanges.

[Sarah Azhari]

However, we know that malware is quite dangerous for crypto users, mainly because they tend to visit various sites such as gambling and porn.

Sometimes, they will attack the explorer too, I have ever seen my balance empty suddenly in Bitcoin Explorer, there is indicated if there is a transfer, it makes me panic and immediately go to another explorer to check what happens. fortunately, my balance is still there, not going to another address. As for this thing, I was close to contacting the explorer, and maybe if I contacted the detected email, they will guide me to give my private key and seed. So becarefull as this thing also.

[Asuspawer09]

It seems ridiculous that it could obtain your 2FA authenticator at some point, some could bypass 2FA authentication because it's already login on the owner's browsers only when you log in to other computers.

As well as visiting gambling or porn websites could not easily infiltrate your computer, I mean you can not download any malware on your computer unless you allow it to be downloaded, when something pops up and you download that exe or file that could possibly be it. I mean you could do a lot of ways to secure your computer and as long as you are aware there's a very low chance that you're gonna get infiltrated.

Ways to secure our PC from hacking

Use a firewall. Installyantivirusysoftwareyyyyyyyyyyyyyyyyyyyyyyy Install an anti-spyware package Use complex passwords Keep your OS, apps and browser up-to-date Ignore spam

Back up your computer Use virtualization Secure your network Use two-factor authentication Use encryption

For mobile devices

• Turn off Bluetooth.
• Don’t use unsecured public Wi-Fi
• Get a security app
• Use a better passcode
• Switch off autocomplete
• Clear your browsing history