Story image

EITest hijacks tech support scam pages to mine cryptocurrency

26 Sep 17

Tech support scams are now being used as social engineering tools as part of EITest’s campaign to deliver Coinhive’s Monero cryptocurrency miner, researchers at Trend Micro Labs report.

EITest has been around since at least 2014 and uses compromised websites to inject malicious scripts and divert browsers to fraudulent websites.

Tech support scams, which scare users into believing there is a problem or infection in their computer, often use websites to con users into paying for services and handing over financial information.

The EITest campaign’s latest moves have involved adding the Coinhive JavaScript (JS) cryptocurrency miner to take over computers and turn them into cryptocurrency miners themselves through the Google Chrome browser.

The phishing script is coded to notify the user to download the Hoefler Text font to properly display the page, but it actually downloads a malicious executable file. EITest takes this up a notch: If the user’s browser is Internet Explorer, he is redirected to a tech support phishing page containing the Coinhive Monero-mining JS script,” researchers continue.

The cryptocurrency miner is the same one that is embedded in The Pirate Bay’s website, researchers state.

The tech support scam asks users to call ‘Microsoft Technical Department’ to apparently fix the issue. However while this is happening, the page loads script from the Coinhive server and launches the JavaScript cryptocurrency miner.

“Users won’t notice that their system has been affected apart from system lags or performance issues,” researchers state.

87% of the infections are hitting Japan, while Australia accounts for 2%. Attacks are also hitting the United States, France, Canada and other countries.

Cryptocurrency mining is becoming a bigger issue for security, as criminals can profit without investing much in their own malware creations.

“For end users, however, the impact isn’t just about system wear-and-tear or performance issues. From January 1 to June 24, for instance, our sensors noted that 20% of cryptocurrency-mining activities entailed web- and network-based attacks. From cross-site scripting and remote code execution to brute force attacks and SQL injection, intrusive and malicious cryptocurrency miningcan threaten the availability and security of a network or system, and the data stored on them. Worse, victims become part of the problem,” researchers state.

Trend Micro recommends the following best practices to prevent and mitigate cryptocurrency mining attacks:

- Update and patch operating systems and browsers
- Be wary of suspicious websites and email attachments
- Consider using JavaScript-blocking applications that prevent scripts like Coinhive from running
- In this case, closing the browser or website will stop the Coinhive script from running.

Stepping up to sell security services in A/NZ
WatchGuard Technologies A/NZ regional director gives his top tips on how to make a move into the increasingly lucrative cybersecurity services market.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Chch crypto-exchange Cryptopia suffers breach
Cryptopia has reportedly experienced a security breach that has taken the entire platform offline – and resulted in ‘significant losses’.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.
Carbon Black: What does cybersecurity have in store for 2019?
Tom Kellerman has shared five insights for the year ahead, including a particularly bold one.
Hands-on review: The Ekster Wallet protects your cards against RFID attacks
For some time now, I’ve been protecting my credit cards with tinfoil. The tinfoil hat does attract a lot of comments, but thanks to Ekster, those days are now happily behind me.
Report on SingHealth breach condemns poor security practices
The 2018 Singapore SingHealth data breach was poorly managed and riddled with vulnerabilities from the start.
Tesla wants people to hack its Model 3
Tesla is offering white hat hackers what could be the chance of a lifetime – the opportunity to hack one of its Model 3 vehicles.