This week in cybersecurity: Scattered Spider hackers sentenced, new macOS malware discovered, and U.S. charges against Russian hosting operators.
In the latest cybersecurity developments, significant incidents have emerged, including the sentencing of hackers involved in a major transport system breach and the discovery of sophisticated malware targeting cryptocurrency wallets.
- Malware targeting macOS has been identified stealing Telegram sessions and swapping cryptocurrency wallets.
- Two members of the hacker group Scattered Spider were sentenced for their role in hacking London's transport system.
- Nearly 300 fraudulent repositories on GitHub were found spreading an infostealer.
- The U.S. has charged operators of Russian Bulletproof hosting services Media Land and ML.Cloud.
New Malware Stealing Cryptocurrency from macOS Users
Security experts from SlowMist uncovered a sophisticated malware targeting macOS, capable of stealing cryptocurrency and accessing Telegram accounts. The malware can bypass two-factor authentication by copying local session files from Telegram Desktop, allowing unauthorized access to user accounts on other devices.
In addition to account theft, the malware tricks users into entering their cryptocurrency wallet seed phrases by replacing legitimate applications with counterfeit versions. It collects sensitive information, including passwords and cookies, from various sources, including cryptocurrency wallets and web browsers.
Users are advised to close active sessions in Telegram, reauthorize their accounts, and create new seed phrases on secure devices to protect their assets.
Scattered Spider Hackers Sentenced for Transport System Attack
In a significant ruling, a UK court sentenced Talha Jubair, 20, and Owen Flowers, 18, to five and a half years in prison for hacking Transport for London (TfL). The attack in August 2024 disrupted services for millions and caused estimated damages of £29 million.
In addition to the TfL hack, Jubair faces multiple charges in the U.S., including involvement in over 120 network breaches, with extortion totaling over $115 million in just one year. The National Crime Agency (NCA) has labeled Scattered Spider as a major cyber threat.
Fraudulent GitHub Repositories Spread Infostealer
Arctic Wolf reported that hackers have created 292 fake GitHub repositories disguised as popular software to distribute an infostealer. Users were lured into downloading malware that stole sensitive information from numerous browsers and cryptocurrency wallets.
The malware, which operates in memory, avoids detection by constantly regenerating its content. The stolen data is sent to a command server in Russia, and GitHub has since removed most of the fraudulent repositories.
U.S. Charges Russian Operators of Bulletproof Hosting Services
The U.S. Department of Justice has charged three Russian nationals involved in operating Bulletproof hosting services, Media Land and ML.Cloud, which supported major ransomware attacks causing over $62 million in damages globally. These services ignored malicious activity complaints and were used for various cybercriminal operations.
The U.S. State Department has offered a $10 million reward for information linking these individuals to foreign governments or their criminal activities, while sanctions have previously been imposed against them by multiple countries.
OkoBot Framework Targets Hardware Wallets
Kaspersky Lab identified the OkoBot framework, which includes a module specifically designed to steal seed phrases from hardware wallet users. This malware operates stealthily, injecting code into legitimate applications to trick users into revealing their sensitive information.
Researchers have recorded hundreds of infections across numerous countries, highlighting the importance of being vigilant against such threats.
Privacy Concerns in Browser Cryptocurrency Wallets
A study by the DistriNet group revealed that many popular browser cryptocurrency wallets allow third-party trackers to link user addresses and track their movements. The audit identified several privacy issues, prompting researchers to notify wallet developers of the vulnerabilities.
Experts recommend users regularly check their extension settings and manage their connected site lists to enhance privacy.
