A new crypto malware has been discovered on The Pirate Bay protocol based on BitTorrent.
The crypto malware triggers a series of illegal activities that replace the most popular web pages used such as Wikipedia, Google and Yandex Search, managing to steal cryptocurrencies.
This anomaly was noticed by a IT security researcher, oxffffo8oo who, when downloading the movie The Girl in the Spider’s Web, realised that there was a .LNK file running a PowerShell command instead of the video file.
The researcher was suspicious and scanned the file with the VirusTotal service which resulted in a low level of danger since this type of attack dates back to 2015 and it is well-known in pirated files online.
The power of this malicious code allows to replace the pages of famous web services and to monitor the pages dedicated to Bitcoin and Ethereum, replacing their wallet addresses with those of the hacker, since it forces the deactivation of Windows Defender and adds extensions in both Firefox (Firefox Protection) and Chrome (Chrome Media Router).
Once the browser is opened, this crypto malware changes some parameters to redirect the victim to suspicious pages such as promotions of better antivirus programs like TotalAV, which is also malicious.
Then, if the victim visits a Wikipedia page, the crypto malware manages to insert a fake donation banner that accepts both Ethereum and Bitcoin with the address of the respective wallets of the hacker.
So downloading files from a torrent can involve more than just watching a movie since this Pirate Bay crypto malware remains installed even after you finish watching the movie.
