Microsoft Defender is an app whose objective is to defend against malware, but what happens when malware outsmarts it?
We’ve all heard the headlines about the volatile world of NFTs, but a new development is that they’re being used to help spread malware. In a particularly extreme case, one PC user thought they were downloading an NFT game, but the only thing which got played was the victim’s Google account. As a result of the Google account being hijacked, the victim ended up losing over $24,000 in cryptocurrency.
This incident, as with many other scams, relied on a momentary lapse of judgement, so we’re going to put it under the spotlight to see what we can learn.
How Did an NFT Game Carry Out a Robbery?
The attack started when the victim received a message from a stranger over Telegram, an encrypted messaging service which prides itself on the anonymity it provides users. The message urged the victim to download a blockchain game called Orbit Unit. Deciding that the message was harmless and the recommendation worthy of investigation, the victim downloaded Orbit Unit and installed it.
Unfortunately, the download was fake and riddled with malware. Once activated, the malware went on to install a malicious Chrome extension. Housed within the Chrome browser, the extension was titled Google Keep Chrome Extension, in an attempt to mimic the genuine Google note keeping app. The malicious app certainly fulfilled its promise of taking notes but did so in a way which compromised the victim’s data. All data entered into Chrome, be it login credentials, cookies, or browser history, was harvested by the malware.
For the victim, it was particularly frustrating as they had Malwarebytes on their PC and it failed to detect the malware. This has been attributed to the victim most likely having the free version of Malwarebytes, where real-time protection isn’t activated. What they did have, though, was Microsoft Defender, an app which promises to help “individuals and families protect their personal data and devices.” In this instance, Microsoft Defender failed spectacularly.
The threat actor behind the malware was able to access the victims Google passwords through Chrome and gain access to their cryptocurrency wallets. It was from here that they were able to steal $24,000 worth of cryptocurrency.
Staying Safe When Malware Protection Fails
You and your employees may not deal in cryptocurrency, but this cyberattack demonstrates the importance of being able to identify a potential attack and protect your data. Therefore, make sure you practice these best security practices:
- Don’t Click Suspicious Links: Any links you receive via email, websites, or mobile devices should always be scrutinized closely before clicking. If they originate from an unknown sender or use unusual language with a sense of urgency to click, you need to get them verified by an IT professional in order to prevent downloading malware.
- Use Real Time Protection Software: Installing anti-malware software should always be a priority, but you need to make sure you’re using one with real-time protection tools. This ensures that malware is identified and stopped in its tracks before it can activate its malicious payload.
- Don’t Use Autologin on Chrome: Sure, it saves you a few minutes over the course of a week, but the autologin feature on Chrome also sets you up to fail. This tool stores login tokens in your browser and means you don’t have to use your password to access sites each time. However, if a threat actor gains access to them – as they did in the attack on LinusTechTips – they can gain access to all of your accounts. Learn how to turn autologin off in this guide.
For more ways to secure and optimize your business technology, contact your local IT professionals.
