A sophisticated malware disguised as a Python-based trading bot has reportedly targeted cryptocurrency traders through a complex supply chain attack.

As highlighted in a recent blog post by the cloud security firm Checkmarx, this malicious software has been designed to resemble a suite of artificial intelligence (AI) trading tools, aimed at stealing sensitive data and emptying crypto wallets.

Checkmarx revealed that the malware was disseminated via the code-sharing platform GitHub and the Python Package Index (PyPi), where Python packages are centrally hosted, affecting both Windows and Mac operating systems.

The malware employs a cunning multi-stage infection strategy, involving a deceptive graphical user interface (GUI) to distract users while guiding them to a counterfeit website. “The CryptoAITools malware features a complex multi-stage infection approach, utilizing a fake site to introduce its secondary payloads. A distinctive element of this attack, in contrast to many previous malicious packages, is the inclusion of a GUI that plays a crucial role in its social engineering tactics. This GUI activates once the second-stage malware is triggered, masquerading as an ‘AI Bot Starter’ application, cleverly designed to divert users’ attention and gather sensitive information while the malware operates in the background.”

Additionally, the perpetrator created a Telegram channel posing as the product’s technical support, further deceiving users with enticing offers for free trials.

“In the Telegram chat, the attacker employs various strategies to attract potential victims, providing ‘bot support’ to build credibility and trust. They promote their GitHub repository as hosting their ‘most powerful bot,’ appealing to those interested in advanced trading tools. The attacker then presents an enticing deal: a free trial period followed by a monthly subscription, creating the illusion of a risk-free and professional offering.”

Checkmarx warns that this malware poses “serious” risks to its victims, including the potential theft of personal identities, browser data, sensitive files, and digital assets.

Stay Updated –
Subscribe to receive email alerts directly to your inbox.

Check Price Action
Follow us on X, Facebook, and Telegram.

Surf The Daily Hodl Mix

Disclaimer: Views expressed on The Daily Hodl are not intended as investment advice. Investors should conduct thorough research before engaging in high-risk investments in Bitcoin, cryptocurrency, or digital assets. Please be aware that your transfers and trades are undertaken at your own risk, and any resulting losses are your own responsibility. The Daily Hodl does not advocate for the buying or selling of cryptocurrencies or digital assets, and does not serve as an investment advisor. Additionally, The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney