Fake Google Translate app from third-party websites infected with crypto malware: Report
A crypto mining malware disguised as the Google Translate app is being used cybercriminals to infect hundreds and thousands of computers worldwide, reveals a new research Check Point Research (CPR). According to CPR, a crypto mining campaign called ‘Nitrokod’, created a Turkish-speaking entity dropped malware from free software available on popular websites such as Softpedia and uptodown. The software can also be easily found through Google when users search “Google Translate Desktop download”.
These applications are Trojenised, which means that it is infected with crypto mining malware. So, when you download the app, you are in fact downloading malware that will automatically install a mining setup for the Monero cryptocurrency, which is based on the Proof-of-Work (PoW) mining model. As a result, cybercriminals get hidden access to the infected computers to scam users and later damage their systems.
The researchers noted that after the initial software installation, the attackers delay the infection process for weeks and delete traces from the original installation. This allows cybercriminals to successfully operate under the radar for years.
Till date, the Turkish-based crypto miner dubbed ‘Nitrokod’ has infected machines across 11 countries. Some of the programs had been downloaded thousands of times, averaging a star score of 9.3 out of 10, despite Google not having an official desktop version for that program.
Meanwhile, over one hundred thousand people across Israel, Germany, the United Kingdom, the United States, Sri Lanka, Cyprus, Australia, Greece, Turkey, Mongolia and Poland have all fallen prey to the malware.
To avoid getting scammed this malware, Maya Horowitz, Vice President of research at Check Point Software advised basic security tips can help reduce the risk. “Beware of lookalike domains, spelling errors in websites, and unfamiliar email senders. Only download software only from authorised, known publishers or vendors and ensure your endpoint security is up to date and provides comprehensive protection,” she said.
