TLDR Tech / InfoSec
Omnistealer uses the blockchain to steal everything it can
Omnistealer is a new info-stealing malware that utilizes blockchain transactions on TRON, Aptos, and Binance Smart Chain to embed encrypted staging code, creating an untake-downable C2 infrastructure. The malware spreads through fake freelance job offers on platforms like LinkedIn and Upwork, leading to trojanized GitHub repositories. It targets over 10 password managers, more than 60 browser-based crypto wallets, major browsers, and cloud storage credentials, with an estimated 300,000 compromised credentials from various sectors. Organizations are advised to implement sandbox policies for third-party code, restrict execution from user-writable directories, and monitor for outbound connections to blockchain RPC endpoints, which serve as an emerging C2 channel.
Read the full story