Evivault technology Archives

The Threat of AMOS Malware on macOS

AMOS malware is a growing threat to macOS users. Hackers are marketing a new malware for the macOS operating system. Named Atomic Macos Stealer or AMOS, this malicious software is designed to steal user data for $1,000 per month. It extracts passwords from the keychain, steals files on disks, cookies, as well as cards and identification information stored in the browser and tries to extract data from 50 different cryptocurrency wallets. Buyers also benefit from a complete web dashboard to brute force MetaMask.

How AMOS Malware Works

AMOS is capable of accessing iCloud keychain passwords, system information, files from the desktop and documents folder, as well as the Mac password. It is able to infiltrate applications such as Chrome and Firefox and extract autofill information, passwords, cookies, wallets and credit card information. Cryptocurrency wallets such as Electrum, Binance and Atomic are specific targets.

The malware is being propagated using an unsigned disk image file called Setup.dmg. Once executed, the file prompts the victim to enter their system password on a bogus prompt. This allows the malware to escalate privileges and carry out its malicious activities. This technique is similar to that used by other macOS malware, such as MacStealer.

How to Protect Against AMOS Malware

The increase in the deployment of macOS stealer malware by non-state actors highlights the need for users to be cautious when downloading and installing software. The cybersecurity industry recommends that users only download and install software from trustworthy sources, enable two-factor authentication, review app permissions, and refrain from opening suspicious links received via email or SMS messages.

The Solution: Keepser Cold Wallet with EviVault Technology

However, there is a solution to protect your sensitive data against AMOS malware. For only €387, you can purchase two NFC Cold Wallet Keepser from Keepser Group with EviVault technology from Freemindtronic SL. These wallets allow you to store offline and physically externalized from macOS and/or PC computers the private keys and/or seed phrases of cryptocurrency wallets as well as identifier and password pairs. Thus, it will simply be impossible to extract sensitive data from a computer that is not physically present in these computers, even for this AMOS malware.

By using EviVault NFC Cold Wallet technologies from Freemindtronic embedded in Keepser products, you can protect your sensitive data against malware attacks such as AMOS or Cryptbot. These wallets also work on macOS, providing additional protection to Mac users.

The Benefits of EviVault Technology

Thanks to EviVault technology developed by Freemindtronic, the Keepser Cold Wallet is a unique ultra-secure cold storage solution for cryptocurrency wallets, offering anonymous, offline and contactless use via NFC technology, as well as compatibility with NFC Android phones and computer systems via a browser extension.

It’s like they say: “Why pay €1,000 per month to steal sensitive data when you can pay €387 one shot for AMOS malware protection without subscription to protect against it (and other malware like Cryptbot)!” 😉

It is important to take seriously the threats posed by malware such as AMOS and to take the necessary measures to protect your sensitive data. By using advanced technologies such as EviVault NFC Cold Wallet from Freemindtronic embedded in Keepser products, you can ensure that your data is secure.

CryptBot malware By Jacques gascuel
This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Article updated on May 3, 2023
Related topic : Amos malware

CryptBot: A Threat to Chrome Users

Cryptbot is a malware that targets Chrome users who store or trade cryptocurrencies. It can steal your data and virtual wallets. Google says it infected 670,000 people in 2022. This article tells you how Cryptbot works, how to detect and remove it, and how to prevent future attacks.

Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?

March 10, 2024

google account security flaw how to protect yourself from hackers digital artwork that conveys the concept of a security breach in online services due to persistent cookies attacks

2024 Articles Digital Security News Phishing

Google OAuth2 security flaw: How to Protect Yourself from Hackers

January 8, 2024

Articles Crypto Currency Cryptocurrency Digital Security EviPass Technology NFC HSM technology Phishing

Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers

December 16, 2023

BITB attacks Browser-In-The-Browser remove delete destroy by IRDR Ifram Redirect Detection Removal since EviCypher freeware web extension open-source from Freemindtronic in Andorra

2023 Digital Security Phishing

BITB Attacks: How to Avoid Phishing by iFrame

May 10, 2023

Snake malware: The Russian that steals sensitive information for 20 years

Articles Digital Security Phishing

Snake Malware: The Russian Spy Tool

May 10, 2023

Articles Cryptocurrency Digital Security Phishing

ViperSoftX How to avoid the malware that steals your passwords

May 7, 2023

AMOS malware protection with Keepser NFC Cold Xallet

Articles Phishing

Protect Your Data from AMOS Malware

May 4, 2023

CryptBot: the malware that targets your data and crypto on Chrome

Articles EviVault Technology Phishing

Cryptbot malware steals data cryptocurrencies

May 1, 2023

Understanding Cryptbot Malware: A Comprehensive Guide to the Threats and Risks

Cryptbot malware is a serious concern for Chrome users, as it surreptitiously steals their confidential information and digital currencies by hiding in malicious extensions that are installed in the browser without their knowledge. Once installed, it can compromise sensitive information such as passwords, banking logins, private keys of cryptocurrencies and browsing history. Moreover, Cryptbot malware can add malicious code in the web pages to misappropriate cryptocurrencies from the users’ wallets or exchanges. Hence, the security threat posed by this malware is severe and requires immediate attention.

Cryptbot Malware: How it Steals Sensitive Data, Including Cryptocurrency Wallets, from Chrome Users

This type of Trojan malware was first detected in December 2019 and is known for disguising itself as authentic software such as Google Chrome or Google Earth Pro and can be downloaded from counterfeit websites. Upon download and installation, the computer gets infected with Cryptbot along with another Trojan, Vidar, both of which are created to identify and steal sensitive data of Chrome users like:

Username and password that are saved in Chrome browser
Browser cookies that may contain session or preference information
Cryptocurrency wallet data, like Ethereum or Bitcoin
Credit card information saved in the browser
Desktop or window screenshots

The data that is collected can often be sold to other hackers who may use it for extortion campaigns or data breaches. Moreover, this malware is capable of taking screenshots of active windows or desktop, exposing even more confidential information. Therefore, Cryptbot malware endangers your privacy and security while putting online accounts, identity, money and personal safety at risk. It may also lead to further malware infections or phishing attempts. Hence, safeguarding against Cryptbot malware is essential, and it should be removed if detected.

CryptBot Malware: How It Spreads Through Fraudulent Websites and Phishing Campaigns, and Its Command and Control Server

CryptBot mainly spreads through fraudulent websites that offer modified or pirated versions of legitimate software such as Google Chrome or Google Earth Pro. These websites encourage users to download and run malicious files, which then install CryptBot on their computer.

This malware can also be distributed through phishing campaigns, which involve sending misleading emails to users, impersonating trusted entities such as Google or Microsoft. These emails often contain links or attachments infected.

Once installed on the victim’s computer, CryptBot connects to a command and control (C&C) server, which gives it instructions on the data to collect and send. CryptBot can automatically update itself to avoid detection and stay hidden on the victim’s computer.

Removing CryptBot Malware from Chrome

If you suspect that your Chrome browser is infected with CryptBot malware, you should take immediate action to remove it. Here are some steps you can follow to detect and remove CryptBot:

Suspicious Extension Check: Open Chrome and click on the three dots icon on the top right corner. Go to More Tools > Extensions and look for any suspicious extensions that you do not recognize or do not remember installing. Remove them by clicking on the Remove button.
Anti-Malware Software Use: Download and install a reputable anti-malware software such as Malwarebytes or Norton. Run a full system scan to detect and remove CryptBot malware from your computer.
Chrome Settings Reset: Go to Chrome Settings > Advanced > Reset and clean up > Restore settings to their original defaults. This will reset your browser settings to their default state and remove any unwanted changes made by CryptBot.
Password Change: If CryptBot has stolen your passwords, you should change them immediately for all affected accounts.

Detecting CryptBot Malware on Your Computer

It is not always easy to detect the presence of CryptBot on your computer, as it is a discreet and silent malware. However, there are some signs that can alert you:

Your computer becomes slower or more unstable
Your Chrome browser displays unwanted ads or redirects you to suspicious websites
You receive security alerts or password reset requests from your online accounts
You notice unusual or unauthorized transactions on your bank accounts or cryptocurrency wallets

If you notice any of these symptoms, it is possible that you are infected by CryptBot. In this case, it is recommended to scan your computer with a reliable and up-to-date antivirus, such as Bitdefender or Malwarebytes. If the scan detects the presence of CryptBot or other threats, follow the instructions to remove them.

Tips for Avoiding CryptBot Malware on Chrome

Best Practices for Computer Security

To avoid being infected by CryptBot malware on Chrome, it is recommended to follow these tips. For this, you need to adopt some good practices of computer security:

Only download software from official and verified sources
Update your applications and operating system regularly
Do not open attachments or links in emails you receive, especially if they come from unknown or unsolicited senders
Use a firewall and security software, such as an antivirus or anti-malware. Update them regularly and run full scans of your system
Follow email best practices, such as not responding to messages that ask for personal or financial information, or that offer deals that are too good to be true
Deploy email security gateways, which filter incoming messages and block those that contain spam, phishing or malware
Avoid links and ads that appear on websites you visit, especially if they promise gifts, discounts or free downloads
Implement access control, which limits access to sensitive resources and data of your company to authorized people only
To enhance the security of your online accounts, enable two-factor or multi-factor authentication which adds an extra layer of protection by requiring a second factor of verification such as a code sent by SMS or a fingerprint..
Use the principle of least privilege, which limits the rights and permissions of users to what is strictly necessary to accomplish their tasks
Use strong and unique passwords: Use strong and unique passwords for each account, and avoid using the same password for multiple accounts.

Enhancing Protection Against CryptBot Malware on Chrome with EviVault’s End-to-End NFC Cold Wallet Technology

Adopting the best practices for computer security, such as downloading software only from official sources, updating applications, avoiding suspicious links and emails, and using a firewall and anti-malware, can help you avoid CryptBot malware and protect your sensitive data and cryptocurrency. In addition to these tips, you can further enhance your protection by using Freemindtronic’s EviVault technology, which provides end-to-end NFC Cold Wallet protection for your crypto assets. This patented solution adds an extra layer of security against threats like CryptBot malware on Chrome.

Google’s Legal Action Against CryptBot Malware and Its Importance in Protecting Chrome Users

Google has successfully obtained a court order to remove current and future domains linked to the distribution of CryptBot, a malware that poses a threat to Chrome users. Google believes that legal action against such security threats, which abuse legitimate software like Chrome, can be effective. The company used a similar strategy against the alleged operators of the Russian botnet Glupteba in 2021, which resulted in a 78% reduction in Glupteba infections.

However, this court order does not mean that the danger of CryptBot is completely eliminated. The malware is constantly evolving and can still infect systems if users are not careful. It is strongly recommended to follow the advice here, including updating applications and operating systems, downloading software from reliable sources, and regularly checking for the presence of CryptBot.

Click here for download US Court Decision in Google LLC vs CryptBot Case

If you want to review the court decision issued by Judge Valerie Figueredo of the Southern District Court of New York in response to Google LLC’s (“Google”) lawsuit against CryptBot infrastructure and distribution networks, which aimed to reduce the number of victims whose sensitive information, such as usernames, passwords, and cryptocurrencies, the malicious software steals, click on the following link to download the document.

Through this legal action, Google sought to reduce the number of victims who fall prey to CryptBot’s theft of sensitive information. This court decision is a crucial step in the fight against sophisticated and difficult-to-detect malware attacks such as CryptBot.

In the next section, we will delve deeper into CryptBot and its inner workings

Malware Targeting Chrome Users: Understanding the Inner Workings of CryptBot

CryptBot is a type of malware that targets Chrome users by stealing their personal data, including cryptocurrency. But how does this malware infiltrate Chrome and avoid detection by antivirus software, and how does it communicate with its command server? Below is a brief technical explanation of CryptBot for those interested in the details:

CryptBot is primarily spread through phishing campaigns that offer a fake Chrome update or other legitimate software that contains a hidden virus. Once installed, the virus creates four files in the %TEMP% folder and activates a disguised BAT file that injects CryptBot into Chrome’s legitimate process. This allows the malware to access and encrypt the user’s data using the AES algorithm before sending it to its command server via an HTTP POST request.
In addition to stealing data, CryptBot can receive instructions from the command server via a JSON and AES-based communication protocol. These instructions can include downloading additional malware, updating the configuration settings, or deleting itself as needed.
Although CryptBot is a dangerous form of malware, understanding how it works can help users protect themselves from future attacks.

In conclusion, the threat CryptBot poses to the security of your data and cryptocurrencies on Chrome is real, but there are steps you can take to protect yourself. By following the advice we have shared and using Freemindtronic’s EviVault technology embedded in cold wallets such as Keepser, you can strengthen the security of your computer and protect your cryptographic assets from hackers. Don’t forget to share this article with your friends and sign up for our newsletter to receive the latest news on computer security and cryptocurrencies.

Protect Your Mac from AMOS Malware

AMOS Malware Protection with Keepser Cold Wallet