Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Sure, I’ll take that! New Combo Jack Malware Alters Clipboards to Steal Cryptocurrency

Summary: Unit 42 and Proofpoint researchers observed a malspam campaign on February 25, 2018 targeting Japanese and American users with a lure claiming a lost passport and an attached PDF containing a scanned copy. The PDF carried an embedded RTF file that exploited CVE-2017-8579 to run an HTA file with encoded PowerShell, delivering a payload dubbed ComboJack that checks the clipboard every half second and swaps copied wallet addresses for attacker-controlled ones across cryptocurrencies, WebMoney, and Yandex Money.

What's compelling: ComboJack relies on a habit nearly every user has: copying a long wallet address to avoid typos, then pasting it without re-reading it. A single swapped paste sends the full transaction to the attacker's wallet, and the malware hides itself with hidden and system attributes and a registry key for persistence.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Mentions
CVE-2017-8579
Related