Latest news about Bitcoin and all cryptocurrencies. Your daily crypto news habit.
âShitcoin Wallet,â an Ethereum wallet available as a Chrome Browser extension, is injecting malicious javascript to steal userâs data.
An Ethereum (ETH) wallet known as âShitcoin Walletâ is reportedly injecting malicious javascript code from open browser windows to steal data from its users. On Dec. 30, cybersecurity and anti-phishing expert Harry Denley warned about the potential breach in a tweet:
â Source Twitter
According to Denleyâs tweet, Chrome browser crypto wallet software Shitcoin Wallet is targeting Binance, MyEtherWallet and other well-known websites containing usersâ passwords and private keys to cryptocurrency.
The Shitcoin Wallet Chrome extension â ExtensionID: ckkgmccefffnbbalkmbbgebbojjogffn â works by downloading a number of javascript files from a remote server. The code then searches for open browser windows containing webpages of exchanges and Ethereum network tools.
The code attempts to scrape data input into those windows. Once it does, the information is sent to a remote server identified as âerc20wallet.tk,â which is a top-level domain address belonging to Tokelau, a group of South Pacific Islands that are part of New Zealandâs territory.
Google Chrome removed MetaMask, but for different reasons
Shitcoin Wallet stealing user data may sound similar to recent incidents including Apple threatening to unlist Coinbaseâs mobile DApp browser from its app store and Google removing Ethereum wallet app MetaMask from its Google Play App Store last week. Both of those instances, however, have been subject to considerable controversy due to lack of evidence of malicious conduct on the part of those apps.
A number of cryptojacking extensions were found on the Google Chrome web store last year. According to a recent report from McAfee Labs, cryptojacking, which occurs when a userâs computing device is secretly used to mine cryptocurrency, has been on the rise, up 29% in Q1 2019.
Shitcoin Wallet was built for trouble online
While the name should be a dead giveaway that itâs better to stay away from this particular Ethereum wallet software, Shitcoin Wallet contains some suspicious added features.Â
According to a company blog post, the Ethereum wallet, which launched on Dec. 9 and claims to have over 2,000 users, is a web-based wallet that has several extensions for different browsers. The blog post notes;
âIt is a web wallet which has several extensions for different browsers, which I will discuss further in the article.â
However, this doesnât square with what the company mentions at the end of that very blog post, which says/reads that Shitcoin Wallet is currently only supported by Chrome.
A few days prior to the malicious javascript attack, Shitcoin Wallet announced the launch of its new desktop app, giving away 0.05 ETH to users who download and install the Shitcoin Wallet desktop app.
While those users may have received a bit of free ETH, they are now left vulnerable to having their data scraped and personal information compromised.
Disclaimer
The views and opinions expressed in this article are solely those of the authors and do not reflect the views of Bitcoin Insider. Every investment and trading move involves risk - this is especially true for cryptocurrencies given their volatility. We strongly advise our readers to conduct their own research when making a decision.