SecureMac has discovered the virus circulating in the wild, covertly spying on users’ web browsing traffic in order to steal login credentials for the wallets used to store the virtual currency. To do so, it simply targets traffic flowing to popular Bitcoin websites, including MtGox and BTC-e, as well as Bitcoin wallet sites like blockchain.info.
It’s been rather successful: a user posting over the weekend on the Reddit discussion site reported losing 20 Bitcoins (worth upwards of $12,000 at the going exchange rate) to the thieves.
The malware comes disguised as an app to send and receive payments on Bitcoin Stealth Addresses. Initial infection occurs when a user installs and runs an app called StealthBit, available for download on GitHub, a website that acts as a repository for open-source code.
“The source code to StealthBit was originally posted on GitHub, along with a precompiled copy of the app for download,” SecureMac noted. “The precompiled version of StealthBit did not match a copy generated from the source code, as it contained a malicious payload. Users who downloaded and ran the precompiled version of StealthBit instead ended up with infected systems.”
OSX/CoinThief.A instead acts as a dropper and installs browser extensions for Safari and the Google Chrome web browser, without alerting the user. The web browsers are tricked into thinking that the user intentionally installed the extensions, and give no warning to the user that all of their web browsing traffic is now being monitored by the malicious extensions.
When a user logs in to check his or her Bitcoin wallet balance, another component of the malware then sends the information back to a remote server run by the malware authors.
OSX/CoinThief.A can both send information to as well as receive commands from a remote server, including a functionality to update itself to newer versions from the malware author, SecuerMac said.
“Information sent back to the server isn't limited to Bitcoin login credentials, but also includes the username and UUID (unique identifier) for the infected Mac, as well as the presence of a variety of Bitcoin-related apps on the system,” it warned.
The infection is difficult to detect
“Some steps were taken by the malware author to disguise the inner workings of OSX/CoinThief.A from casual analysis,” SecureMac noted. “The browser extensions were given the generic name of "Pop-Up Blocker" and show a similarly generic description of "Blocks pop-up windows and other annoyances."
The malware additionally checks to see if various security programs or code development tools are present on an infected system, which is sometimes done in an attempt to block security researchers from analyzing a piece of malware.
Users can help protect themselves by carefully parsing available reviews and information on any third-party apps before downloading.