Blackberry has detected several malware families that are being used to run massive campaigns for stealing crypto from devices.

In the August edition of ‘The BlackBerry Global Threat Intelligence Report,’ the former titan of the smartphone industry found that finance, healthcare, and government are the top three industries with the highest distribution of cyberattacks.

Malware Everywhere

From March 2023 to May 2023, BlackBerry’s cybersecurity solutions managed to stop over 1.5 million attacks, during which it identified the crypto industry as being ripe for fraudsters who prey on unsuspecting victims. The attackers are expanding their range of tools to evade defensive controls, particularly targeting legacy solutions that rely on signatures and hashes.

BlackBerry’s telemetry has identified an ongoing trend in the usage of commodity malware like ‘RedLine,’ which is capable of extracting various sensitive information, including saved credentials, credit card details, and cryptocurrency data.

‘SmokeLoader’ is one of the most prominent malware families that has been a recurring presence in the threat landscape.

Since its first appearance in 2011, SmokeLoader has become immensely popular. Initially associated with Russian-based threat actors until 2014, it has been employed to distribute a variety of malware, ranging from ransomware and infostealers to crypto miners and banking Trojans.

Spam emails, weaponized documents, and spearphishing attacks are some of the ways SmokeLoader is distributed to the victims.

Once it infiltrates a victim’s system, SmokeLoader establishes a persistence mechanism to survive reboots, employs DLL injection to camouflage within legitimate processes, conducts host enumeration, and downloads/installs additional files or malware to further its malicious activities.

RaccoonStealer, categorized as an infostealer, is designed to acquire browser cookies, passwords, auto-fill web browser data, and cryptocurrency wallet information. This malware has gained notoriety for being offered as Malware-as-a-Service (MaaS) on dark web forums and similar platforms.

Targe