Cybercriminals Target Ethereum Developers with Fake Hardhat npm Packages

Cybersecurity researchers have revealed several malicious packages on the npm registry that have been found impersonating the Nomic Foundation's Hardhat tool in order to steal sensitive data from developer systems. "By exploiting trust in open source plugins, attackers have infiltrated these...

Malicious code in bitcor-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72b64aa1479d9e5fae10ef50a34b24b32b9bb09f98fd3bc301e6954ef6bffe82 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10607 Malicious code in bitcor-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72b64aa1479d9e5fae10ef50a34b24b32b9bb09f98fd3bc301e6954ef6bffe82 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10608 Malicious code in bitcore-mnemic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a72a50d12427111f0b683bda37a019abbeeee63bc70ac6278b220df90b87991 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10609 Malicious code in bitcore-mnemoic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab9b0ec80242884d35432aaa1d154e06c0b6b7e99cff7afcbd8f4834cb9d584d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...

New Android SpyAgent Malware Uses OCR to Steal Crypto Wallet Recovery Keys

Android device users in South Korea have emerged as a target of a new mobile malware campaign that delivers a new type of threat dubbed SpyAgent. The malware "targets mnemonic keys by scanning for images on your device that might contain them," McAfee Labs researcher SangRyol Ryu said in an...

Malicious code in mnemonic-to-address (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5372 Malicious code in mnemonic-to-address (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in bip39-mnemonic-decrypt (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4818 Malicious code in bip39-mnemonic-decrypt (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Check Point Warns of Zero-Day Attacks on its VPN Gateway Products

Check Point is warning of a zero-day vulnerability in its Network Security gateway products that threat actors have exploited in the wild. Tracked as CVE-2024-24919 CVSS score: 8.6, the issue impacts CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, and...

Watch Out: These PyPI Python Packages Can Drain Your Crypto Wallets

Threat hunters have discovered a set of seven packages on the Python Package Index PyPI repository that are designed to steal BIP39 mnemonic phrases used for recovering private keys of a cryptocurrency wallet. The software supply chain attack campaign has been codenamed BIPClip by ReversingLabs...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

Design/Logic Flaw

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

CVE-2024-23660

The CVE-2024-23660 entry concerns Binance Trust Wallet for iOS (version 0.0.4). The root cause is misuse of the trezor-crypto library, causing mnemonic words to be generated with device time as the sole entropy source. This leads to predictable mnemonics and potential theft of funds, with real-wo...

CVE-2024-23660

The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 202...

Binance Trust Wallet app Security Feature Issue Vulnerability

Binance Trust Wallet app is an application by Binance to securely send, receive and store Bitcoin and many other cryptocurrencies and digital assets. A security signature issue vulnerability exists in previous versions of the Binance Trust Wallet app iOS 3cd6e8f647fbba8b5d8844fcd144365a086b629f,...

PT-2024-20010 · Trezor +1 · Trezor-Crypto +1

Name of the Vulnerable Software and Affected Versions: Binance Trust Wallet app for iOS version 0.0.4 Description: The Binance Trust Wallet app for iOS misuses the trezor-crypto library, generating mnemonic words that use the device time as the only entropy source. This has led to economic losses...