steal

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

According to Bitcoin News monitoring, security researchers have found that versions 1.1 and 1.2 of FomoPeek distributed through the Apple App Store contain an iOS exploit framework that can escape the application sandbox, capable of extracting keychain data, wallet files, and mnemonic phrases. SlowMist has linked this application to multiple theft incidents and traced nearly $580,000 worth of stolen USDT flowing into a main address.Users who have installed either version should consider the keys accessible on their iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

Cybersecurity company Hudson Rock disclosed that the Reddit verified account of the streaming service HBO Max was hijacked earlier this month and deployed 108 malicious ads within approximately 48 hours. These ads used a non-existent HBO Max native macOS application as bait, luring users to open Terminal or PowerShell and paste malicious commands, a technique known as ClickFix.Researchers named this operation PasteSwitch, and its delivery system adapts based on the visitor's device and the advertised software. Observed Mac payloads include MacSync and Atomic macOS (AMOS) information-stealing trojans, targeting browser credentials, Telegram data, Apple Notes, saved passwords, and cryptocurrency wallet recovery phrases. The malware also utilized Binance Smart Chain contracts as variable C2 address delivery points and was associated with a cryptocurrency clipboard hijacker that replaces clipboard wallet addresses.According to Malwarebytes, Reddit administrators have suspended the related ads and initiated a security investigation following reports. The report did not specify how the account was compromised or the number of victims, nor was there evidence found that the HBO Max streaming service itself was breached. The ClickFix technique has previously been used multiple times in attacks targeting cryptocurrency users, including approximately 2,000 compromised WordPress sites and malicious activities disguised as CAPTCHA.

According to Reuters, Mexican authorities discovered an illegal cryptocurrency mining operation in a remote mountainous building in Tehuacán, Puebla, where 300 GPUs, 80 medium-voltage terminals, and 8 satellite antennas were found on-site. Authorities are investigating whether the operation is stealing electricity from a nearby hydroelectric power station.This is the fourth similar crypto farm discovered in the area since early last year, with three others found near a hydroelectric power station in northern Puebla last year. Local residents reported that the noise from the equipment can be heard from a kilometer away. Mexican security analyst David Saucedo stated that drug trafficking groups seem to have reached a new level of sophistication, as establishing such operations requires technical expertise and support from well-funded groups.Chainalysis Latin America expert Caio Motta pointed out that such operations are usually located in areas with extremely low electricity prices or within the reach of organized crime to steal electricity and establish large-scale mining infrastructure.

According to Decrypt, the Mexican federal prosecutor, in conjunction with the Navy and Puebla state police, conducted a raid on a property in the remote mountainous area of Tlaola, Puebla, seizing approximately 300 cryptocurrency mining machines, as well as transformers, medium-voltage terminals, and satellite internet antennas.The investigation revealed that the mining operation illegally tapped into the grid of the Nuevo Necaxa hydroelectric power station, and authorities have filed charges for "theft of electricity." Currently, forensic accountants are tracing the source of the hardware funding, and money laundering suspicions have not been ruled out. Data from the Mexican Federal Electricity Commission shows that from January to July 2024, non-technical electricity losses reached up to 6,346 gigawatt-hours, valued at approximately 13.8 billion pesos (about 817 million USD).

According to the Slow Fog Security Team, they have detected an attack activity disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2.The attackers exploited six vulnerabilities codenamed DarkSword to form a complete attack chain, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write, allowing them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground.The Slow Fog team stated that the aforementioned six vulnerabilities have now been patched by Apple, and the current attack belongs to the reuse of n-day vulnerability chains. Simply visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.

According to Cointelegraph, cybersecurity company Morphisec has revealed that a counterfeit desktop application disguised as "Claude Opus 5 Free Desktop" from Anthropic is being used to spread the Windows malware RevStealer. This software can steal data from over 50 types of cryptocurrency wallets, while also collecting sensitive information such as browser passwords, cookies, VPN configurations, message logs, and screenshots.RevStealer has anti-detection mechanisms that perform environmental checks on the target device before execution; if it detects characteristics of a debugging or virtual environment, it will stop running. In addition, Russian cybersecurity company Kaspersky has also disclosed another new malware framework targeting cryptocurrency investors called OkoBot, which can harvest wallet files, inject malicious extensions, and capture wallet application windows to steal assets.

According to security company Huntress, hackers are spreading theft malware to cryptocurrency users by forging Google Docs files, hosting malicious files on GitHub, and impersonating Claude.ai pages. Attackers disguise themselves as senior employees of CoinDesk on the social platform X, luring victims to open Google Docs documents containing malicious code under the pretext of inviting them to an online meeting, thereby guiding users to install the malicious program themselves.Mac users face the threat of Atomic macOS Stealer (AMOS), which can steal browser passwords, cryptocurrency wallet data, and Telegram files; Windows users are pushed fake Google API Connector updates, which, once installed, implant NetSupport RAT and a counterfeit Ledger hardware wallet application. Additionally, hackers are placing false advertisements on search engines like Bing, enticing users to visit counterfeit Claude.ai pages and execute malicious commands. The related malware MacSync and SectopRAT can steal cookies, saved passwords, recovery phrases, and payment card information.Security company Socket also discovered 16 malicious extensions targeting Chrome and Edge, capable of emptying EVM, Solana, and Tron wallet assets.

Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after installing a transcription application using a download link provided in the Claude chat window. The link pointed to a counterfeit website and bundled malware that attempted to steal all information from his device upon execution. Numa Lunah mentioned that he cleared and reinstalled the affected laptop and found no sensitive information leaked.Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide written by him and contained instructions to re-download the malware and steal credentials every time it was loaded. Microsoft Defender Experts had warned that attackers had shifted from search engine optimization poisoning to large language model response poisoning, with related tactics including recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Crypto industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

According to a report by Decrypt, security company Socket released research results linking 77 Firefox extensions to what it calls a "wallet theft factory," with 40 confirmed to have malicious behavior.These extensions disguise themselves as Web3 products like OKX, Rabby Wallet, and TronLink, tricking users into importing wallets through fake wallet interfaces or using modified real wallet code to steal mnemonic phrases and private keys as users input them. Mozilla's signature records show that this activity lasted from March 9 to August 3, and multiple extensions were still online at the time of Socket's report.About half of the extensions displayed realistic wallet interfaces and prompted users to import existing wallets, thereby intercepting the inputted mnemonic phrases or private keys; another 13 were modified versions of Rabby that sent account data stored in wallets to external servers while functioning normally; and 5 specifically collected saved credentials and clipboard content.Additionally, 37 extensions disguised themselves as password generators, dark mode toggles, VPNs, currency converters, and note-taking tools, but actually ran sports score applications sharing the same hardcoded credentials. Nine confirmed malicious extensions were initially released as score applications for sports like football and basketball, with subsequent updates replacing them with wallet theft code.Socket named this activity the "wallet theft factory," but cautioned that it has not confirmed whether all extensions are controlled by the same operator. The Socket team stated that any user who has entered mnemonic phrases or private keys into these extensions should consider it a "permanent leak" and immediately transfer funds to a new wallet, as uninstalling the extensions cannot undo the mnemonic phrases sent elsewhere.

According to CoinDesk, the Internal Revenue Service (IRS) has issued a warning that a sophisticated email phishing campaign targeting U.S. cryptocurrency holders is spreading. Attackers are impersonating official tax letters to lure users into scanning malicious QR codes to steal cryptocurrency wallet credentials and private keys.It is reported that attackers are sending paper letters impersonating the IRS, creating a sense of urgency under the guise of "tax compliance" and "account verification," and including QR codes in the letters. Once users scan the code, they may be directed to a counterfeit website, leading to the leakage of wallet login information, recovery phrases, or private keys, resulting in the theft of digital assets.The IRS reminds taxpayers that official agencies will not request users to provide cryptocurrency wallet private keys, recovery phrases, or perform similar "wallet verification" operations through unofficial channels. Cryptocurrency holders should be vigilant against any suspicious emails and letters that request scanning QR codes, connecting wallets, or submitting sensitive information.As the number of cryptocurrency asset holders grows, social engineering attacks targeting digital wallets continue to increase, and regulatory and security agencies are strengthening warnings against related fraudulent activities.

According to Decrypt, the U.S. Department of Justice has filed charges against 17 hackers allegedly affiliated with Iran's Mabna Institute, accusing them of participating in years-long cyber attack activities, including the 2017 breach of U.S. cable network HBO, where they stole data and demanded approximately $6 million in ransom paid in Bitcoin. Prosecutors claim that the organization conducted hacking attacks on behalf of the Iranian Islamic Revolutionary Guard Corps and other Iranian government clients, targeting hundreds of universities, businesses, and government agencies worldwide, stealing at least 31.5 TB of academic data and intellectual property.The organization also targeted over 100,000 professor accounts, breaching about 8,000 accounts across 144 U.S. universities and 178 foreign universities. The U.S. State Department is offering a reward of up to $10 million for information leading to the whereabouts of five of the defendants. In recent months, the U.S. Treasury has imposed sanctions on several Iranian cryptocurrency exchanges and frozen over $131 million in cryptocurrency assets related to the Iranian central bank and the Revolutionary Guard.

According to Decrypt, security company Bitdefender has warned that the newly released Hollywood blockbuster "The Odyssey" has been embedded with Lumma Stealer information-stealing malware by attackers, who are attempting to steal users' cryptocurrency wallets, passwords, and browser data through fake movie files.Bitdefender revealed that the malicious files began spreading within days of the film's release, with attackers disguising them as high-definition WEBRip or Blu-ray version resources and using names similar to legitimate torrent files to entice users to download. In reality, these files are not videos but Windows executable programs that, when run, will infect the device. Attackers often replace the file icons to make them look like VLC player or video files, while also taking advantage of Windows' default setting to hide file extensions, reducing users' ability to recognize the risk.Once executed, Lumma Stealer will collect saved passwords, payment information, autofill data, remote desktop credentials, and sensitive information including cryptocurrency wallets. Additionally, the malware will steal authentication cookies, allowing attackers to potentially bypass some account protections even if the user has enabled multi-factor authentication (MFA).

According to CNA, the Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA) reported that a cryptocurrency scam involving fake job postings and compromised software systems resulted in losses of $11.8 million.The scam group impersonated cryptocurrency company recruiters on LinkedIn, used forged domain names to send emails, conducted video interviews, and induced victims to download malware on company devices to complete "technical tests," thereby stealing session tokens, bypassing multi-factor authentication, and ultimately transferring cryptocurrency.

According to Cryptopolitan, cybersecurity company Malwarebytes discovered that a user on a cybercrime forum is selling a "scam toolkit" for $500, which can set up a fake $TSLA token presale website with almost no technical background required.The scam process is as follows: after visitors enter an X username, the page displays their real avatar to create the illusion of a "targeted invitation," combined with a countdown and price increase warnings to create a sense of urgency. If victims choose the "15% reward link wallet" option, they will be asked to enter a 12-word recovery phrase, resulting in their wallet being emptied; if they choose to "invest" directly, they must send cryptocurrency assets to an address controlled by the scammers, and then see a fabricated balance on a fake dashboard. The toolkit's control panel allows operators to track victims in real-time, collect recovery phrases, and check wallet balances in advance to decide whether to strike. Malwarebytes discovered this toolkit on May 16, and recently IRS and Ledger users have also encountered similar phishing attacks.

On-chain detective ZachXBT posted that U.S. threat actor Tiffany Milanovich participated in the theft of approximately $5 million in crypto assets by impersonating hardware wallet and centralized exchange customer service.Her methods included disguising as Bitcoin IRA email support, during one attack transferring about $1.2 million in BTC and ETH from the victim's Trezor wallet, and in another case stealing about $500,000 in BTC from a Coinbase account. Tiffany induced victims to hand over access to their funds under the guise of "customer service calls," later boasting about the stolen money on social media and Telegram groups, mocking victims with recordings, and collaborating with other threat actors to launder money using phishing panels and instant exchange services, with some of the stolen funds still dormant on-chain.The threat actor codenamed "Tiffany" is suspected of participating in multiple crypto asset thefts, gambling the stolen funds at crypto casinos. The platform Shuffle has frozen related accounts based on evidence submitted by ZachXBT; Tiffany previously shared a search and seizure warrant from Connecticut, dated before some of the incidents involved.ZachXBT has obtained chat logs, recordings, and on-chain evidence, anticipating that this individual may face further legal consequences. This threat actor is also linked to the John Daghita (Lick) case, who is suspected of stealing over $46 million in crypto assets from a U.S. government-seized wallet.

According to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running the Lightning Network Daemon (LND) software after attackers exploited a serious vulnerability to obtain credentials and transfer funds.BTCPay stated that this restriction prevents external wallets like Zeus from connecting through the BTCPay Server domain. BTCPay mentioned that Lightning payments can continue, and they plan to restore remote access options when they deem it safe.