VenomSoftX: A Threat to Cryptocurrency and Data Security

Overview of VenomSoftX and ViperSoftX Threats

VenomSoftX is a malicious Chrome extension that poses a significant threat to cryptocurrency security. It is deployed by the ViperSoftX Windows malware, which operates as a JavaScript-based remote access trojan and crypto hijacker. This malware specifically targets popular cryptocurrency exchanges, including Blockchain.com, Binance, Coinbase, Gate.io, and Kucoin.

How VenomSoftX Operates

The VenomSoftX extension is known for intercepting clipboard contents and API requests to these exchanges. It manipulates transactions by redirecting funds to attackers' wallets. The extension can also alter HTML on websites, publicizing the user's crypto wallet address and modifying transaction details in the background to favor the threat actor.

Impact and Detection

Since early 2022, Avast Threat Labs has detected numerous ViperSoftX infection attempts, with around 93,000 instances across countries like the US, Italy, India, and Brazil. By probing wallet addresses associated with ViperSoftX and VenomSoftX, Avast discovered that these wallets accumulated approximately $130,000 by November 2022.

Targeted Services and Methods

VenomSoftX is particularly adept at hooking into API requests, enabling it to monitor victims' assets and manipulate transaction amounts, often increasing them to the maximum limit to siphon off funds. This sophisticated approach places users' cryptocurrencies and sensitive information at significant risk.

Conclusion

The VenomSoftX Chrome extension, facilitated by ViperSoftX malware, represents a formidable threat to both cryptocurrency exchanges and individual users. Its ability to hijack transactions and access sensitive data highlights the urgent need for robust cybersecurity measures and vigilant monitoring of browser extensions.