Inferno Drainer Malware Returns, steal $ 9 million from crypto portfolios in six months

Crypto-stole malware Inferno Drainer remains in operation despite the public closing and is used to grab more than $ 9 million from crypto portfolios in the past six months.

According to CyberSecurity Firm Check Point Research, more than 30,000 crypto portfolios have been emptied by the reviving malware campaign, of which the developers claimed to have stopped the activities in November 2023.

A spokesperson for CPR told Decrypt That the figure was based on “Data obtained from reverse engineering of the JavaScript code of the drain, decoding the configuration received from the C&C server and analyzes the activity on the chains.” The majority of the observed was on Ethereum And Binance chainthey added.

CPR analysts reported that Inferno drainer Smart contracts To this day, implementation was still active in 2023, while the current version of the malware appears to have improved compared to the previous iteration.

Allegedly, the malware is now able to use smart contracts for one -time use and encrypted configurations in chain, making it much more difficult to detect and prevent attacks. In addition, command-and-control server communication is obscured through proxy-based systems, which means that tracking has become even more difficult.

In addition to a phishing campaign aimed at Discord users, the revival of Inferno Draininer comes. According to CPR analysts, the campaign techniques for social engineering used to divert users of a legitimate web3 project to a forged site that simulates the verification UX for popular Discord Bot Collab.land. The Nepcollab.land site organized a cryptocurrency drain, which misled victims to sign malicious transactions -attackers to gain access to their funds.

By combining “targeted deception and effective social engineering -tactics”, the malware campaign has generated a “stable financial stream that has been identified by blockchain transaction -analysis,” said CPR analysts.

Crypto users are advised to get extra caution when they interact with unknown platforms. The fake collab.land Bot identified by resuscitation only contained “subtle visual differences” for the legitimate bone, and the cyber criminals behind the deception are likely to “continue to refine their imitation,” the researchers said.

Because the legitimate collab.land -service requires users to verify their wallets by signing, they noticed: “even experienced cryptocurrency users can lower their guard” when they are presented with the fake bot -making it even more important to verify the authenticity before they connect wallets with a service.

The revival of Inferno Drainer is just one of a number of malware campaigns to come up in recent months. Hackers are taking on more and more advanced techniques to deliver crypto-stealing malware, aimed at hacked mailing lists, open-source Python libraries and even for loading Trojans on counterfeit Android telephones.