“Through their various modules, the RATs enable the attackers control over the victims’ machines.”įrom a technical standpoint, Stefanko and Strýček explained that trojanizing Telegram was a relatively straightforward task for the threat actors, as the app’s code is open source. The cybersecurity researchers also said they found Windows versions of the wallet-switching clippers, together with Telegram and WhatsApp installers for Windows, packed with remote access trojans (RATs). “Furthermore, some of the clippers abused OCR to extract mnemonic phrases out of images saved on the victims’ devices, a malicious use of the screen reading technology that we saw for the first time.” This was the first time we have seen Android clippers focusing specifically on instant messaging,” wrote ESET malware researchers Lukas Stefanko and Peter Strýček in a Thursday advisory. “All of them are after victims’ cryptocurrency funds, with several targeting cryptocurrency wallets. Read more on clipper malware here: Shein App Accessed Clipboard Data on Android Devices

Dozens of websites set up to deliver trojanized versions of WhatsApp and Telegram apps have been spotted targeting Android and Windows users.Īs discovered by security researchers at ESET, most of these apps rely on clipper malware designed to steal or modify the contents of the Android clipboard.

Telegram link