A new cryptocurrency mining worm appeared on Facebook (NASDAQ:FB) that uses an ingenious combination of social engineering, multi-platform coordination, and rapid propagation techniques. It’s impressively sophisticated and proves once again that hackers are willing to go to great lengths to grab cryptocurrencies.
“Our Cyber Safety Solutions team identified a malicious Chrome extension we named FacexWorm, which uses a miscellany of techniques to target cryptocurrency trading platforms accessed on an affected browser and propagates via Facebook Messenger,” reported Trend Micro.
Much like Dubmine, which wreaked havoc on Messenger last year, FacexWorm propagates itself through a malicious Chrome extension that sends links to itself to everyone the victim knows on the messaging platform. This new strain, however, takes things a step further and recreates a very convincing fake YouTube page that you supposedly need the extension for.
Once infected, the victims’ computers will be directed to the hacker’s cryptocurrency platform referral links or scams instead of the legitimate pages they attempted to access. In addition, the virus also makes attempts to steal any credentials for cryptocurrency sites and Google (NASDAQ:GOOGL) accounts.
And of course, no malware package would be complete without a way to mine coins for the hacker. FacexWorm injects an obfuscated version of Coinhive’s Monero mining script into every website the victim visits.
For those who are concerned about infection, Chrome got rid of the extension, leaving the hackers almost empty-handed as they reportedly only managed to infect a small number of subjects.
Still, if you wish to prevent this kind of attack from happening, be wary of any Chrome extension requests on your browser that pop up when you click links sent by people you know. A quick search for the extension’s name followed by the word “virus” should tell you whether you should install it or not.
This article appeared first on Cryptovest