Researchers Spot New Cryptocurrency Stealing Malware Advertised Under a Subscription Model
A cryptocurrency-related malware program has been advertised on world market darknet forums as the “leading way to make money in 2021,” raising alarms among the cybersecurity community. Palo Alto Networks published a report about the malicious app Westeal and outlined the creator’s ties with other types of malware that steals major streaming services accounts.
Westeal Claims to Be Immune Against Major Antivirus Software
According to the company that deals in cybersecurity, “Westeal” is an evolution from “Wesupply Crypto Stealer,” another malicious crypto software that has been in circulation in May of this year. Research suggests that Wesupply’s evolution is being advertised since February 2021.
The study shows that Westeal was created to steal bitcoin (BTC) and Ethereum (ETH) entering and out victim’s wallet through their clipboard.
Furthermore, those who download the malicious application gain access to a web-based panel that handles all operations that are required, including a “victim tracker panel.”
One of the things that has raised concerns by Palo Alto Networks is the fact that Westeal is reportedly immune to major antivirus software.
The malware works with a subscription model, and “Complexcodes,” the anon author of the app, earns money by charging 20 euros ($24) every month fifty euro ($60) over three consecutive months, and 125 euros ($150) per year.
The Malware Is a ‘Shameless’ Crypto Stealer, Researchers Say
The cybersecurity company provides more details on the malware:
“In the effort to “steal” cryptocurrency from a victim, Westeal uses regular expressions to look for strings matching the patterns of bitcoin and ethereum wallet identifiers being copied to the clipboard. When it matches these, it replaces the copied wallet ID in the clipboard with one supplied by the malware. The victim then pastes the substituted wallet ID for a transaction, and the funds are sent instead to the substitute wallet.”
Still, Palo Alto Networks qualifies Westeal as a “shameless” malware:
“Westeal is a shameless piece of commodity malware with a single, illicit function. Its simplicity is matched by a likely simple effectiveness in the theft of cryptocurrency. The low-sophistication actors who purchase and deploy this malware are thieves, no less so than street pickpockets. Their crimes are as real as their victims. The fast and simple monetization chain and anonymity of cryptocurrency theft, together with the low cost and simplicity of operation, will undoubtedly make this type of crimeware attractive and popular to less-skilled thieves.”