Ứng Dụng Ví Tiền Điện Tử Độc Hại Lợi Dụng Google Play Trong Nhiều Tháng, Đánh Cắp 70 Nghìn Đô
Một ứng dụng ví tiền điện tử độc hại, giả mạo WalletConnect, đã sử dụng các kỹ thuật né tránh tiên tiến để không bị phát hiện trên Google Play, lừa đảo hơn 150 người dùng mất 70.000 đô.
["M\u1ed9t c\u00f4ng ty b\u1ea3o m\u1eadt IT \u0111\u00e3 ti\u1ebft l\u1ed9 r\u1eb1ng m\u1ed9t \u1ee9ng d\u1ee5ng v\u00ed ti\u1ec1n \u0111i\u1ec7n t\u1eed \u0111\u1ed9c h\u1ea1i \u0111\u00e3 \u1edf tr\u00ean c\u1eeda h\u00e0ng Google Play trong h\u01a1n n\u0103m th\u00e1ng, \u0111\u00e1nh c\u1eafp h\u01a1n 70.000 \u0111\u00f4.<\/p>","
\u1ee8ng d\u1ee5ng n\u00e0y, \u0111\u00e3 ng\u1ee5y trang th\u00e0nh giao th\u1ee9c WalletConnect ph\u1ed5 bi\u1ebfn, \u0111\u00e3 l\u1eeba ng\u01b0\u1eddi d\u00f9ng li\u00ean k\u1ebft v\u00ed ti\u1ec1n \u0111i\u1ec7n t\u1eed c\u1ee7a h\u1ecd v\u1edbi nh\u1eefng g\u00ec h\u1ecd tin l\u00e0 c\u00e1c \u1ee9ng d\u1ee5ng t\u00e0i ch\u00ednh phi t\u1eadp trung (DeFi) h\u1ee3p ph\u00e1p.<\/p>","
C\u00f4ng ty b\u1ea3o m\u1eadt \u0111\u00e3 l\u01b0u \u00fd trong b\u00e1o c\u00e1o ng\u00e0y 26 th\u00e1ng 9 r\u1eb1ng \u0111\u00e2y l\u00e0 tr\u01b0\u1eddng h\u1ee3p \u0111\u1ea7u ti\u00ean m\u00e0 c\u00e1c c\u00f4ng c\u1ee5 l\u1ea5y c\u1eafp c\u1ee5 th\u1ec3 nh\u1eafm v\u00e0o ng\u01b0\u1eddi d\u00f9ng di \u0111\u1ed9ng.<\/p>","
\u1ee8ng d\u1ee5ng \u0111\u00e3 \u0111\u1ea1t \u0111\u01b0\u1ee3c h\u01a1n 10.000 l\u01b0\u1ee3t t\u1ea3i xu\u1ed1ng b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng c\u00e1c \u0111\u00e1nh gi\u00e1 gi\u1ea3 v\u00e0 th\u01b0\u01a1ng hi\u1ec7u nh\u1ea5t qu\u00e1n, \u0111i\u1ec1u n\u00e0y \u0111\u00e3 gi\u00fap n\u00f3 x\u1ebfp h\u1ea1ng cao trong k\u1ebft qu\u1ea3 t\u00ecm ki\u1ebfm.<\/p>","
H\u01a1n 150 ng\u01b0\u1eddi d\u00f9ng \u0111\u00e3 tr\u1edf th\u00e0nh n\u1ea1n nh\u00e2n c\u1ee7a v\u1ee5 l\u1eeba \u0111\u1ea3o n\u00e0y, m\u1ea5t kho\u1ea3ng 70.000 \u0111\u00f4. Kh\u00f4ng ph\u1ea3i t\u1ea5t c\u1ea3 ng\u01b0\u1eddi d\u00f9ng \u0111\u1ec1u b\u1ecb \u1ea3nh h\u01b0\u1edfng; m\u1ed9t s\u1ed1 ng\u01b0\u1eddi kh\u00f4ng k\u1ebft n\u1ed1i v\u00ed ho\u1eb7c nh\u1eadn ra v\u1ee5 l\u1eeba \u0111\u1ea3o, trong khi nh\u1eefng ng\u01b0\u1eddi kh\u00e1c kh\u00f4ng \u0111\u00e1p \u1ee9ng c\u00e1c ti\u00eau ch\u00ed m\u1ee5c ti\u00eau c\u1ee5 th\u1ec3 c\u1ee7a ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i.<\/p>"," M\u1ed9t s\u1ed1 \u0111\u00e1nh gi\u00e1 gi\u1ea3 tr\u00ean \u1ee9ng d\u1ee5ng WalletConnect gi\u1ea3 m\u1ea1o \u0111\u00e3 \u0111\u1ec1 c\u1eadp \u0111\u1ebfn c\u00e1c t\u00ednh n\u0103ng kh\u00f4ng li\u00ean quan g\u00ec \u0111\u1ebfn ti\u1ec1n \u0111i\u1ec7n t\u1eed. Ngu\u1ed3n: Check Point Research<\/em><\/p><\/figcaption><\/figure>"," \u1ee8ng d\u1ee5ng \u0111\u00e3 c\u00f3 s\u1eb5n tr\u00ean c\u1eeda h\u00e0ng \u1ee9ng d\u1ee5ng c\u1ee7a Google t\u1eeb ng\u00e0y 21 th\u00e1ng 3, s\u1eed d\u1ee5ng c\u00e1c k\u1ef9 thu\u1eadt n\u00e9 tr\u00e1nh ti\u00ean ti\u1ebfn \u0111\u1ec3 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n. N\u00f3 \u0111\u00e3 b\u1ecb g\u1ee1 b\u1ecf k\u1ec3 t\u1eeb \u0111\u00f3.<\/p>"," Ban \u0111\u1ea7u \u0111\u01b0\u1ee3c xu\u1ea5t b\u1ea3n d\u01b0\u1edbi t\u00ean 'Mestox Calculator', \u1ee9ng d\u1ee5ng \u0111\u00e3 tr\u1ea3i qua nhi\u1ec1u l\u1ea7n thay \u0111\u1ed5i t\u00ean, nh\u01b0ng URL c\u1ee7a n\u00f3 v\u1eabn ch\u1ec9 \u0111\u1ebfn m\u1ed9t trang web m\u00e1y t\u00ednh t\u01b0\u1edfng ch\u1eebng nh\u01b0 v\u00f4 h\u1ea1i.<\/p>"," C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u gi\u1ea3i th\u00edch r\u1eb1ng ph\u01b0\u01a1ng ph\u00e1p n\u00e0y \u0111\u00e3 cho ph\u00e9p \u1ee9ng d\u1ee5ng v\u01b0\u1ee3t qua qu\u00e1 tr\u00ecnh ki\u1ec3m tra c\u1ee7a Google Play b\u1eb1ng c\u00e1ch t\u1ea3i m\u1ed9t \u1ee9ng d\u1ee5ng m\u00e1y t\u00ednh 'v\u00f4 h\u1ea1i' trong qu\u00e1 tr\u00ecnh ki\u1ec3m tra.<\/p>"," D\u1ef1a tr\u00ean \u0111\u1ecba ch\u1ec9 IP v\u00e0 lo\u1ea1i thi\u1ebft b\u1ecb c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, m\u1ed9t s\u1ed1 ng\u01b0\u1eddi \u0111\u00e3 b\u1ecb chuy\u1ec3n h\u01b0\u1edbng \u0111\u1ebfn m\u1ed9t m\u00e1y ch\u1ee7 ph\u1ee5 \u0111\u1ed9c h\u1ea1i ch\u1ee9a ph\u1ea7n m\u1ec1m l\u1ea5y c\u1eafp v\u00ed MS Drainer.<\/p>"," S\u01a1 \u0111\u1ed3 c\u00e1ch \u1ee9ng d\u1ee5ng WalletConnect gi\u1ea3 m\u1ea1o ho\u1ea1t \u0111\u1ed9ng \u0111\u1ec3 l\u1ea5y c\u1eafp m\u1ed9t s\u1ed1 ti\u1ec1n c\u1ee7a ng\u01b0\u1eddi d\u00f9ng. Ngu\u1ed3n: Check Point Research<\/em><\/p><\/figcaption><\/figure>"," T\u01b0\u01a1ng t\u1ef1 nh\u01b0 c\u00e1c v\u1ee5 l\u1eeba \u0111\u1ea3o l\u1ea5y c\u1eafp v\u00ed kh\u00e1c, \u1ee9ng d\u1ee5ng \u0111\u00e3 y\u00eau c\u1ea7u ng\u01b0\u1eddi d\u00f9ng k\u1ebft n\u1ed1i v\u00ed c\u1ee7a h\u1ecd, m\u1ed9t y\u00eau c\u1ea7u t\u01b0\u1edfng ch\u1eebng nh\u01b0 b\u00ecnh th\u01b0\u1eddng khi xem x\u00e9t c\u00e1ch ho\u1ea1t \u0111\u1ed9ng c\u1ee7a \u1ee9ng d\u1ee5ng th\u1eadt.<\/p>"," Ng\u01b0\u1eddi d\u00f9ng sau \u0111\u00f3 b\u1ecb l\u1eeba c\u1ea5p c\u00e1c quy\u1ec1n kh\u00e1c nhau d\u01b0\u1edbi danh ngh\u0129a x\u00e1c minh v\u00ed, \u0111i\u1ec1u n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng chuy\u1ec3n s\u1ed1 ti\u1ec1n t\u1ed1i \u0111a c\u1ee7a c\u00e1c t\u00e0i s\u1ea3n \u0111\u01b0\u1ee3c ch\u1ec9 \u0111\u1ecbnh.<\/p>"," \u1ee8ng d\u1ee5ng tr\u01b0\u1edbc ti\u00ean nh\u1eafm v\u00e0o c\u00e1c token c\u00f3 gi\u00e1 tr\u1ecb h\u01a1n tr\u01b0\u1edbc khi chuy\u1ec3n sang c\u00e1c token r\u1ebb h\u01a1n, t\u1ed1i \u0111a h\u00f3a t\u00e1c \u0111\u1ed9ng t\u00e0i ch\u00ednh \u0111\u1ed1i v\u1edbi n\u1ea1n nh\u00e2n.<\/p>"," C\u00f4ng ty b\u1ea3o m\u1eadt \u0111\u00e3 nh\u1ea5n m\u1ea1nh s\u1ef1 gia t\u0103ng t\u00ednh tinh vi c\u1ee7a c\u00e1c chi\u1ebfn thu\u1eadt t\u1ed9i ph\u1ea1m m\u1ea1ng, l\u01b0u \u00fd r\u1eb1ng \u1ee9ng d\u1ee5ng \u0111\u00e3 s\u1eed d\u1ee5ng c\u00e1c h\u1ee3p \u0111\u1ed3ng th\u00f4ng minh v\u00e0 li\u00ean k\u1ebft s\u00e2u \u0111\u1ec3 l\u1eb7ng l\u1ebd l\u1ea5y c\u1eafp t\u00e0i s\u1ea3n sau khi ng\u01b0\u1eddi d\u00f9ng b\u1ecb l\u1eeba t\u01b0\u01a1ng t\u00e1c v\u1edbi n\u00f3.<\/p>"," C\u00f4ng ty nh\u1ea5n m\u1ea1nh t\u1ea7m quan tr\u1ecdng c\u1ee7a vi\u1ec7c c\u1ea3nh gi\u00e1c c\u1ee7a ng\u01b0\u1eddi d\u00f9ng khi t\u1ea3i xu\u1ed1ng c\u00e1c \u1ee9ng d\u1ee5ng, ngay c\u1ea3 nh\u1eefng \u1ee9ng d\u1ee5ng c\u00f3 v\u1ebb h\u1ee3p ph\u00e1p, v\u00e0 th\u00fac gi\u1ee5c c\u00e1c c\u1eeda h\u00e0ng \u1ee9ng d\u1ee5ng c\u1ea3i thi\u1ec7n quy tr\u00ecnh x\u00e1c minh c\u1ee7a h\u1ecd.<\/p>"," C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u nh\u1ea5n m\u1ea1nh s\u1ef1 c\u1ea7n thi\u1ebft ph\u1ea3i ti\u1ebfp t\u1ee5c gi\u00e1o d\u1ee5c c\u1ed9ng \u0111\u1ed3ng ti\u1ec1n \u0111i\u1ec7n t\u1eed v\u1ec1 nh\u1eefng r\u1ee7i ro c\u1ee7a c\u00f4ng ngh\u1ec7 Web3, v\u00ec ngay c\u1ea3 nh\u1eefng t\u01b0\u01a1ng t\u00e1c t\u01b0\u1edfng ch\u1eebng nh\u01b0 v\u00f4 h\u1ea1i c\u0169ng c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn thi\u1ec7t h\u1ea1i t\u00e0i ch\u00ednh \u0111\u00e1ng k\u1ec3.<\/p>"," Google ch\u01b0a ph\u1ea3n h\u1ed3i ngay l\u1eadp t\u1ee9c v\u1ec1 y\u00eau c\u1ea7u b\u00ecnh lu\u1eadn v\u1ec1 v\u1ea5n \u0111\u1ec1 n\u00e0y.<\/p>"]
Theo Cointelegraph
Tin khác
