Connect with us

Beware of Cryptocurrency Mining Virus Spreading Through Facebook Messenger

spreading through facebook messenger

apps

Beware of Cryptocurrency Mining Virus Spreading Through Facebook Messenger

Beware of Cryptocurrency Mining Virus Spreading Through Facebook Messenger

spreading through facebook messenger

If you receive a video file (packed in zip archive) sent by someone (or your friends) on your Facebook messenger — just don’t click on it.

Researchers from security firm Trend Micro are warning users of a new cryptocurrency mining bot which

is spreading through Facebook Messenger and targeting Google Chrome desktop users to take advantage
of the recent surge in cryptocurrency prices.

Dubbed Digmine, the Monero-cryptocurrency mining bot disguises as a non-embedded video file,

under the name video_xxxx.zip (as shown in the screenshot), but is actually contains an AutoIt
executable script.
Once clicked, the malware infects victim’s computer and downloads its components and related configuration
files from a remote command-and-control (C&C) server.

Digimine primarily installs a cryptocurrency miner, i.e. miner.exe—a modified version of an open-source

Monero miner known as XMRig—which silently mines the Monero cryptocurrency in the background
for hackers using the CPU power of the infected computers.

spreading through facebook messenger

Besides the cryptocurrency miner, Digimine bot also installs an autostart mechanism and launch Chrome

with a malicious extension that allows attackers to access the victims’ Facebook profile and spread the

same malware file to their friends’ list via Messenger.

Since Chrome extensions can only be installed via official Chrome Web Store, “

the attackers bypassed this by launching Chrome (loaded with the malicious extension) via command line.

“The extension will read its own configuration from the C&C server. It can instruct the extension to either proceed with logging in to Facebook or open a fake page that will play a video” Trend Micro researchers say.

“The decoy website that plays the video also serves as part of their C&C structure. This site pretends to be a video streaming site but also holds a lot of the configurations for the malware’s components.”

It’s noteworthy that users opening the malicious video file through the Messenger

app on their mobile devices are not affected.

Since the miner is controlled from a C&C server, the authors behind Digiminer can upgrade their malware to add different functionalities overnight.
Digmine was first spotted infecting users in South Korea and has since spread its activities to Vietnam,
Azerbaijan, Ukraine, Philippines, Thailand, and Venezuela. But since Facebook Messenger is used worldwide, there are more chances of the bot being spread globally.

When notified by Researchers, Facebook told it had taken down most of the malware files from the social networking site.

Facebook Spam campaigns are quite common. So users are advised to be vigilant when clicking on links and files provided via the social media site platform.

You May Also Like:  UK Asks Amazon And eBay To Stop Selling ‘Prison Phones
Continue Reading
You may also like...
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

More in apps

popular post

To Top
%d bloggers like this: