Protecting Against Venom Stealer Malware Attacks for Cryptocurrency

Venom Stealer MaaS Enables ClickFix Attacks and Crypto Theft

Cybersecurity researchers have uncovered a new malware-as-a-service (MaaS) called Venom Stealer that facilitates ClickFix attacks leading to the theft of cryptocurrency and credentials.

How it Works

• The MaaS is offered to vetted cybercriminals for a monthly fee of $250 or a lifetime license of $1,800.
• The Venom Stealer platform allows users to conduct attacks ranging from social-engineering templates to the cracking of cryptocurrency wallets and persistence monitoring of browser activity for further credential theft.
• The platform provides four different ClickFix templates, two for Windows and two for macOS, including a fake Cloudflare CAPTCHA, a fake operating system update, a fake SSL certificate error, and a fake font installation page.

Methods of Attack

• Ventos Stealer extracts sensitive data including saved passwords, session cookies, browsing history, autofill data, and cryptocurrency wallet vaults.
• The infostealer can bypass Chrome’s v10 and v20 password encryption, allowing passwords to be harvested silently without the user’s knowledge.

Persistence and Exfiltration

• To persist on the victim’s machine, Venom Stealer continues to monitor Chrome login data, automatically extracting any new credentials saved to the browser.
• Funds from cracked wallets are then transferred to the attacker across nine different blockchains.

Recommendations for Defense

• Organizations should restrict PowerShell execution and use Group Policy to disable the use of the Run dialog by standard users.
• Monitoring outbound traffic is also crucial for catching data exfiltration.

About Author

Vaibhav

See author's posts