#SecureYourAssets

In the wallets

Once the malicious package is installed, it begins scanning the device for installed cryptocurrency wallets, especially Atomic and Exodus. If found, the malware extracts the application files into temporary folders, then injects malicious code into them, and repackages the files in a way that makes them appear intact and unmodified.

Replacing addresses and transferring funds to the attackers

The danger of this attack lies in its modification of the code responsible for sending cryptocurrencies within the wallet, such that the recipient's address is replaced with another address owned by the attacker, using base64 encoding to hide the address within the code.

The transaction appears normal in the wallet interface, while the funds are sent to a malicious address without the user's knowledge.

No visible indicators of compromise

One of the most concerning aspects is that the user does not notice any changes in the user interface or during the transaction execution. No warning messages or signs indicate manipulation has occurred.

The anomaly is only discovered when reviewing the transaction details on the blockchain, revealing that the funds were sent to an unknown address.