Crypto Archives - Recon Bee

Evelyn Stealer Malware Abuses VS Code Extensions to Steal Developer Credentials and Crypto

20Jan

By RBNo Comments

News

Evelyn Stealer Malware Abuses VS Code Extensions to Steal Developer Credentials and Crypto

Cybersecurity researchers have revealed information about a malware campaign that uses the Microsoft Visual Studio Code (VS Code) extension ecosystem to target software engineers with a new information stealer named Evelyn Stealer. The malware is meant to steal private data, such as cryptocurrency-related information and developer credentials. According to an investigation released on Monday by Trend Micro, compromised developer environments can potentially be leveraged as entry points into larger corporate systems. It further stated that the activity is intended to identify companies that have access to production systems, cloud resources, or digital assets, as well as software development teams that depend on Visual Studio Code and third-party extensions. It's important to note...

N. Korean Hackers Used Job Lures, Cloud Account Access, and Malware to Steal Millions in Crypto

1Aug

By RBNo Comments

News

N. Korean Hackers Used Job Lures, Cloud Account Access, and Malware to Steal Millions in Crypto

UNC4899, a threat actor associated with North Korea, has been implicated in attacks that targeted two distinct firms by contacting their employees using Telegram and LinkedIn. Google's cloud division stated [PDF] in its Cloud Threat Horizons Report for H2 2025 that UNC4899 used social engineering techniques to successfully persuade the targeted employees to run malicious Docker containers on their workstations under the pretense of freelance opportunities for software development work. Activity monitored under the names Jade Sleet, PUKCHONG, Slow Pisces, and TraderTraitor coincides with UNC4899. The state-sponsored actor has been active since at least 2020 and is well-known for focusing on the blockchain and cryptocurrency sectors. Significant cryptocurrency heists, such as those...

Over 70 Malicious npm and VS Code Packages Found Stealing Data and Crypto

27May

By RBNo Comments

News

Over 70 Malicious npm and VS Code Packages Found Stealing Data and Crypto

Up to 60 malicious npm packages that have the ability to capture hostnames, IP addresses, DNS servers, and user directories to an endpoint under Discord control have been found in the package registry. In a report released last week, Socket security researcher Kirill Boychenko stated that the packages, which were distributed under three distinct identities, include an install-time script that is activated during npm install. Together, the libraries have been downloaded more than 3,000 times. According to the software supply chain security business, the script targets Windows, macOS, or Linux computers and incorporates basic sandbox evasion tests, making any compromised workstation or continuous integration node a possible source of useful reconnaissance. The three accounts' names...

Israel arrests new suspect behind Nomad Bridge $190M crypto hack

19May

By RBNo Comments

News

Israel arrests new suspect behind Nomad Bridge $190M crypto hack

Alexander Gurevich, an American-Israeli national, was detained in Israel on suspicion of helping hackers steal $190 million in August 2022 by taking advantage of the Nomad bridge smart-contract. Gorevich, who is said to have been a major player in one of the biggest attacks in DeFi history, was identified thanks to crucial information provided by blockchain intelligence platform TRM Labs to international law enforcement authorities. According to TRM Labs, Israeli police detained Alexander Gurevich, the suspect, in Jerusalem after coordinating with the FBI, DOJ, and Interpol. Gurevich is a dual national of the United States and Israel. The blockchain intelligence firm claims that because the legal procedures have already been accepted, Gurevich will shortly be extradited to the Un...

Chinese Android Phones Shipped with Fake WhatsApp, Telegram Apps Targeting Crypto Users

16Apr

By RBNo Comments

News

Chinese Android Phones Shipped with Fake WhatsApp, Telegram Apps Targeting Crypto Users

Since June 2024, trojanized apps that pose as Telegram and WhatsApp and feature cryptocurrency clipper capability have been seen pre-installed on low-cost Android handsets made by Chinese enterprises. Although the practice of stealing financial information through malware-laced apps is not new, recent research from Russian antivirus provider Doctor Web indicates a sharp increase in the number of threat actors preloading new devices with malicious apps by directly targeting the supply chains of different Chinese manufacturers. According to the firm, fraudulent programs were found directly in the phone's pre-installed software. In this instance, the WhatsApp messenger was modified to include the malicious code. Most of the affected handsets are reportedly low-end phones that imitat...

Bybit Confirms Record-Breaking $1.5 Billion Crypto Heist in Sophisticated Cold Wallet Attack

24Feb

By RBNo Comments

News

Bybit Confirms Record-Breaking $1.5 Billion Crypto Heist in Sophisticated Cold Wallet Attack

The greatest cryptocurrency heist in history occurred on Friday when cryptocurrency exchange Bybit disclosed that a "sophisticated" attack had stolen more than $1.5 billion worth of bitcoin from one of its Ethereum cold (offline) wallets. The event happened as a result of a transfer from our ETH multisig cold wallet to our warm wallet. "Unfortunately, this transaction was manipulated through a sophisticated attack that changed the underlying smart contract logic while masking the signing interface and displaying the correct address," Bybit stated in a post on X. Consequently, the attacker managed to take over the compromised Ethereum cold wallet and move its contents to an unspecified address read more about Bybit Confirms Record-Breaking $1.5 Billion Crypto Heist in Sophisticated C...

Google Warns of Rising Cloaking Scams, AI-Driven Fraud, and Crypto Schemes

15Nov

By RBNo Comments

News

Google Warns of Rising Cloaking Scams, AI-Driven Fraud, and Crypto Schemes

Google has disclosed that fraudulent actors are using tactics such as landing page masking to pose as trustworthy websites in order to carry out scams. According to Laurie Richardson, VP and Head of Trust and Safety at Google, cloaking is deliberately made to stop moderation teams and systems from examining content that violates policies, allowing them to spread the fraud directly to users. The landing pages frequently imitate popular websites and instill a sense of urgency to trick users into buying phony or unrealistic goods. The technique of providing consumers and search engines like Google read more about Google Warns of Rising Cloaking Scams AI-Driven Fraud and Crypto Schemes. Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity wit...

Millions stolen from crypto platforms Exactly Protocol and Harbor Protocol

25Aug

By RBNo Comments

News

Millions stolen from crypto platforms Exactly Protocol and Harbor Protocol

Over the past several days, two cryptocurrency platforms have experienced thefts amounting to millions of dollars' worth of cryptocurrency, forcing both to suspend operations and alert clients to possible losses. Exactly Protocol, a decentralized financial platform, acknowledged on Friday that it was "actively investigating a security issue" and has temporarily suspended the protocol, limiting user activity to asset withdrawals. Exactly Protocol, which said on August 4 that it has received deposits totaling more than $100 million, let users to lend and borrow cryptocurrency assets at fixed and variable rates. According to a number of news sources and industry professionals, the platform lost more than $12 million as a result of the theft read more Millions stolen from crypto plat...

Crypto crackdown continues in New York with third fraud case announced

14Jul

By RBNo Comments

News

Crypto crackdown continues in New York with third fraud case announced

This week, the Southern District of New York federal court unsealed yet another case involving purported bitcoin fraud. It appears that the local authorities are adamant about delivering a message to all types of cybercriminals. The third case involving digital assets to be announced by the court in as many days is a father-and-son alleged duo who are accused of stealing almost $10 million in cryptocurrency from about 20 victims. On suspicion of operating fraudulent bitcoin investment schemes between 2018 and 2021 is Eugene Austin, 60, of Port Jefferson, New York. In April of this year, his son Brandon, 27, of Coram, New York, filed a guilty plea, which was made public by the US Department read more Crypto crackdown continues in New York with third fraud case announced. Stay info...

Cyber Criminals Are Using Mining Pools to Launder Crypto

19Jun

By RBNo Comments

News

Cyber Criminals Are Using Mining Pools to Launder Crypto

According to Chainanlysis, cybercriminals are increasingly sending their stolen money to crypto mining pools to conceal where it came from. The blockchain analysis company claimed that these malevolent actors use mining pools, which allow groups of miners to pool their processing capabilities, as a de facto mixer. Remember that you cannot track cryptocurrency through services, including mining pools, so in this scenario the mining pool functions similarly to a mixer in that it obscures the source of funds and gives the impression that the money is coming read more Cyber Criminals Are Using Mining Pools to Launder Crypto. Stay one step ahead of cyber threats with ReconBee.com. Explore our comprehensive coverage of recent cyber attacks, cybersecurity awareness, and the latest cyber...