Malware Campaign Delivers Remote Access Backdoor and Fake MetaMask Wallet to Steal Cryptocurrency Funds
North Korean threat actors have launched an attack campaign targeting IT professionals in the cryptocurrency, Web3, and artificial intelligence sectors.
North Korean threat actors have launched an attack campaign targeting IT professionals in the cryptocurrency, Web3, and artificial intelligence sectors.
The operation, identified as Contagious Interview, involves deploying remote access backdoors and trojanized MetaMask wallet extensions to steal digital assets.
Malicious code is concealed within fake job interview assessments using poisoned NPM packages executed during skills evaluations.
The campaign uses malware families named BeaverTail and InvisibleFerret, updated with enhanced data theft capabilities.
Recent variants demonstrate techniques for manipulating browser extensions and intercepting cryptocurrency credentials.
The malware establishes persistent backdoor access while searching for sensitive files, including wallet data and password managers, across Windows, macOS, and Linux systems.
North Korean threat actors have launched an attack campaign targeting IT professionals in the cryptocurrency, Web3, and artificial intelligence sectors.
A Threat Intelligence analyst identified the latest attack chain , revealing a streamlined infection process.
The initial JavaScript payload performs essential functions such as beacon transmission and downloading subsequent attack stages, reducing detection likelihood.
The campaign involves manipulating legitimate MetaMask wallet extensions. A lightweight backdoor scans for MetaMask extensions in Chrome and Brave browsers.
When detected, a trojanized version is downloaded, modifying browser configuration files. Chrome's security mechanisms are manipulated using valid HMAC-SHA256 signatures to bypass detection.
The fake MetaMask extension includes about 15 malicious lines injected into the submitPassword function. This captures master passwords and encrypted vault files, transmitting data to attacker servers.
Organizations should monitor suspicious NPM packages and implement strict code review processes.
Network administrators should block communication to command-and-control infrastructure. Users should verify MetaMask extension integrity through official browser stores.
Regular monitoring of browser extension permissions is advised to detect compromise attempts. Security teams should implement detection rules targeting file exfiltration and unauthorized browser configuration modifications.
Developers should avoid executing untrusted NPM packages, especially during recruitment processes.
Based on reporting by Cyber Security News.