Partnered With:

Beware of malware known as Mars Stealer, which is targeting online wallets such as MetaMask and Coinbase Wallet

Read this article in 3 Minutes

The new malware works by directly targeting an encrypted wallet as a browser extension

律动 BlockBeats 消息，2 月 2 日，据安全研究机构 3xport 称新型恶意软件「Mars Stealer」，对 2019 年信息窃取 Oski 木马进行了升级。新的恶意软件通过直接针对作为浏览器扩展的加密钱包，如 MetaMask、Binance Chain Wallet 或 Coinbase Wallet，使在线钱包的安全性变得更加复杂。

Mars Stealer 可以通过各种渠道传播，例如文件托管网站、Torrent 客户端和任何其他下载器。在感染系统后，恶意软件做的第一件事就是检查设备语言。如果它匹配的语言 ID 为哈萨克斯坦，乌兹别克斯坦，阿塞拜疆，白俄罗斯或俄罗斯，软件将离开系统没有任何恶意行为。对于世界其他地方，恶意软件的攻击目标是包含敏感信息的文件，如加密钱包的地址信息和私钥。一旦盗窃完成，它就会自动删除痕迹并离开系统。黑客目前在暗网论坛上仅以 140 美元的价格出售 Mars Stealer。

MetaMask, Nifty Wallet, Coinbase Wallet, MEW CX, Ronin Wallet, Binance Chain Wallet and TronLink were listed as targeted wallets. Security experts note that malware can target chrome extensions other than Opera. Unfortunately, this means that some of the most common browsers, such as Google Chrome, Microsoft Edge and Brave, are also on the list. In addition, while Firefox and Opera are protected from extension-specific attacks, they are also vulnerable to certificate hijacking.