Cryptocurrency Python Library Targeted by Wallet Draining Malware

Equipment learning has been used to identify crypto malware targeting users of bitcoinlib, a famous Python collection for making Bitcoin cards.

ReversingLabs says the malignant packages attempted to overwrite genuine commands in order to remove delicate database files.

Experts say bitcoinlib is a “widely used open-source librarian” that allows bitcoin cards to be created and managed—attracting more than one million files since its launch.

Named “bitcoinlibdbfix” and “bitcoinlib-dev”, the ransomware had been masquerading as alternatives to an issue that had caused error messages to emerge during Bitcoin payments.

The experts say the renegade coders concerned even joined a discourse on GitHub and lobbied for their libraries to be run, but another developers properly recognized it was a hoax.

Both deals have now been removed and cannot be saved, meaning they no longer represent a threat to developers.

According to ReversingLabs, they were detected using complex algorithms that determine whether items behave in a similar way to ransomware discovered in the past.

Researchers say this technology is a vital source of protection against” the rising sea of technology supply chain problems targeting cryptocurrency”, and proves successful even if ransomware isn’t accompanied by social engineering attacks.

” The number of new items that get published on a daily basis is posing a problem for security agencies, and ML model-based diagnosis is currently the best solution that the security industry is provide”, ReversingLabs expert Karlo Zanki said.

This is the latest in a long series of activities specifically targeting crypto designers.

Back in February, Kaspersky had warned that ransomware was being distributed through GitHub libraries commonly used by professionals. If installed, it may sabotage the defendant’s keyboard and remove wallet addresses with ones controlled by the attackers.

Meanwhile, a new variant of XCSSET has emerged that can take screenshots, record what a user is doing, and steal data from their Telegram account.