Bitcoin-Stealing Mac OS X Trojan Discovered

A new Mac OS X trojan horse that monitors web browsing traffic in order to steal Bitcoins has been discovered by SecureMac. The trojan, called OSX/CoinThief.A, is disguised as an innocuous Bitcoin app called StealthBit that purports to send and receive anonymous payments.

The app was posted on open-source website GitHub, but the precompiled version of the app had the malicious payload installed. The malware installs browser extensions in Safari and Google Chrome looking for login credentials for a number of Bitcoin related websites including MtGox, BTC-e, and blockchain.info. When the app finds login credentials, it sends those back to the malware's developer.

Initial infection occurs when a user installs and runs an app called "StealthBit," which was recently available for download on GitHub, a website that acts as a repository for open source code. The source code to StealthBit was originally posted on GitHub, along with a precompiled copy of the app for download. The precompiled version of StealthBit did not match a copy generated from the source code, as it contained a malicious payload. Users who downloaded and ran the precompiled version of StealthBit instead ended up with infected systems. A user posting over the weekend on Reddit, the popular discussion site, reported losing 20 Bitcoins (currently worth upwards of $12,000 USD) to the thieves.

Bitcoin users who may have downloaded the app should check their browser extensions in Safari and Google Chrome for generic "Pop-Up Blocker" extensions.

Top Rated Comments

(View all)

mdnz

56 months ago

GitHub blew it. They should check all packages before hosting them.

Yes, GitHub should check the million lines of code and the hunderds of packages uploaded every second to make sure there isn't any malicious code in there.

If you don't know what you're talking about, just don't say anything.

Rating: 17 Votes

OldSchoolMacGuy

56 months ago

but i thought if i got my mac i wouldn't any viruses! darn pc vs mac commercials.

You're willingly turning over your login and pass and admin access to your computer. No operating system in the world will stop this type of thing from gain access when you hand it the keys. It's not your security systems fault if you give the burglar your alarm code.

Rating: 12 Votes

Creep89

56 months ago

So the user has to download and install the malware.

Rating: 11 Votes

Corrode

56 months ago

It's not a virus...blah blah blah. Every time.

Rating: 9 Votes

azentropy

56 months ago

This type of Trojan horse always reminds me of the joke when viruses were first becoming popular. Sanitized to be PC...

XXXXX Virus:
You have just received the "XXXXXX Virus." As the we have no
programming experience, this virus works on the honor system.
Please delete all the files on your hard drive and manually forward
this virus to everyone on your mailing list.

Thank you for your cooperation,
XXXXXXX

Rating: 9 Votes

carjakester

56 months ago

but i thought if i got my mac i wouldn't any viruses! darn pc vs mac commercials.

Rating: 7 Votes

BigBeast

56 months ago

So the user has to download and install the malware. Sorry, if you are that stupid than they should grab your credit card information as well.

I wouldn't say stupid per say, but definitely naive. Also, I would assume that if you are savvy enough to understand bit coins, their use, etc., then you are savvy enough to protect yourself for this situation, but you know what they when you assume...

Rating: 7 Votes

FloatingBones

56 months ago

but i thought if i got my mac i wouldn't any viruses! darn pc vs mac commercials.

That's about as good as NBC's "All visitors to Sochi Immediately Hacked" claim:

[media=youtube]waEeJJVZ5P8[/media]

Their claims were thoroughly debunked in the article That NBC story 100% fraudulent (http://blog.erratasec.com/2014/02/that-nbc-story-100-fraudulent.html). If I were Putin, I would have ejected the "journalist" who filed that story. :rolleyes:

Rating: 7 Votes

Solver

56 months ago

Virtual theft for virtual money needs the virtual police.

Rating: 6 Votes