According to Bitdefender, a leading cybersecurity company, there is a new type of password stealer targeting cryptocurrency wallets users have installed on their PCs. BHUNT, as this new malware is known, infects computers through software that is infected, usually cracked software. According to the technical document published on the software, BHUNT targets Exodus, Electrum, Atomic, Jaxx, and Ethereum, Bitcoin, and Litecoin wallets. After installation, the software can also steal other private data residing on the infected computer, as well as transfer funds to another wallet.
Computers can already be infected by different viruses that have the capability of stealing passwords, so password thieves are not new to the PC sector. This software is unique because its decryption is heavy and its digital signature is not matching its binary. It is packaged as digitally signed software, but the issued certificate does not match it.
BHUNT was released into the wild with no clear target according to Bitdefender. According to Bitdefender’s report, the software spreads as follows: We found that all our telemetry came from home users who are more likely to have installed cryptocurrency wallet software. They are also more likely to install cracks for their operating systems, which may be the primary source of infection.
A map of the infections detected in each country was displayed, and Australia, Egypt, Germany, India, Indonesia, Japan, Malaysia, Norway, Singapore, South Africa, Spain, and the U.S. had the most infections.
The cybersecurity company also issued recommendations to prevent infection with BHUNT or other types of password-stealing malware. “The most effective way to combat these threats is to avoid downloading software from untrusted sources and to maintain security solutions,” says Bitdefender.
