Crypto Wallets Under Attack: You Won’t Believe What Hackers Are Doing!

by
  • Malicious npm package hijacks Atomic and Exodus wallets. Because why not?
  • Attackers replace crypto addresses to steal user funds. Surprise!

So, guess what? A brand new software supply chain attack has popped up in the npm registry, and it’s targeting users of popular cryptocurrency wallets like Atomic Wallet and Exodus. The malicious npm package, charmingly named pdf-to-office, claims to convert PDFs to Word documents. But in reality, it’s more like a magician’s trick—now you see your crypto, now you don’t! 🎩✨

npm Malware Alters Crypto Addresses in Fund Transfers

According to the security wizards at ReversingLabs, this sneaky package is overriding cryptocurrency wallet addresses during fund transfers. Picture this: you’re trying to send your hard-earned crypto, and poof! The attacker quietly swaps your wallet address with their own. It’s like a financial magic show, but instead of applause, you get a big fat zero in your account. 🎭💸

This little gem of a package made its debut on npm on March 24, 2025, and since then, developers have been busy with three updates. The latest version, 1.1.2, has racked up 334 downloads. I guess some people really love living on the edge! 😬

But wait, there’s more! This isn’t a one-off incident. Just weeks before this debacle, two other npm packages, ethers-provider2 and ethers-providerz, were also caught in the crossfire of an exposure attack. These packages were trying to establish reverse shell connections on vulnerable machines. Because who doesn’t want a little remote access to your computer, right? 🙄

Now, back to our star of the show, pdf-to-office. This malware is like a targeted missile. It first checks if you have the Atomic Wallet installed. If you do, it’s game over! It overwrites your system file key with a modified version that’s basically a Trojan horse in disguise. Talk about a sneaky little bugger! 🐴💻

And don’t think the Exodus wallet is safe either! It’s getting the same treatment, specifically targeting versions 2.91.5 and 2.90.6 of Atomic Wallet and versions 25.13.3 and 25.9.2 of Exodus. It’s like a bad sequel that nobody asked for! 🎬

Malware Keeps Redirecting Crypto Funds Even After Uninstall

Here’s the kicker: uninstalling the malicious npm package doesn’t fix the damage. Nope! The infected wallet software remains, and your funds keep getting redirected. It’s like trying to get rid of a bad roommate—just when you think they’re gone, they pop back up! 🏠💔

This attack is a clear sign that cybercriminals are stepping up their game. Supply chain attacks are now the trendy thing to do on the open-source software platform npm. These vulnerabilities are like ninjas—hard to spot and even harder to fight off! 🥷

And if that’s not enough, a threat analysis from ExtensionTotal revealed that 10 malicious Visual Studio Code extensions managed to sneak in. These extensions are like the unwanted guests at a party, downloading PowerShell scripts and disabling your Windows security functions. It’s a real party crasher situation! 🎉🚫

In conclusion, these recent discoveries show that cybercriminals are constantly evolving their tactics to rob crypto users. So, developers and users, stay alert! The software world is changing faster than a TikTok dance trend, and you need to keep your software protected to avoid becoming the next victim. 💃🕺

 

Read More

2025-04-11 22:10