Google Chrome has recently discovered a malicious extension called “VenomSoftX” that can be used to steal users’ cryptocurrency and sensitive data. The extension, installed via the ViperSoftX malware for Windows, is a JavaScript-based RAT (Remote Access Trojan) and cryptocurrency hijacker.
The ViperSoftX malware was exposed back in 2020, as previously disclosed in a joint report released by security research firms Cerberus, Colin Cowie, and Fortinet.
Today, security firm Avast shared more details about the malicious browser extension and the malware’s recent malicious developments. Since the beginning of 2022, Avast has detected and blocked 93,000 ViperSoftX infection attempts against its customers, primarily affecting users in the United States, Italy, Brazil and India.
By analyzing the hard-coded wallet addresses in the ViperSoftX and VenomSoftX samples, Avast found that both had earned its hackers a combined total of approximately $130,000 by November 8, 2022. This stolen cryptocurrency was obtained by transferring attempted cryptocurrency transactions on the attacked devices, excluding profits from parallel activities.
