Hackers steal cryptocurrency through pirated copies of Nolan's Odyssey

Attackers have begun distributing the Lumma Stealer, a digital asset theft program, disguised as pirated copies of Christopher Nolan's recently released film "The Odyssey."

These viruses appeared online a few days after the film's premiere, according to blockchain security specialists at Bitdefender. The viruses disguise themselves as high-quality copies of the film—WEBRip and Blu-ray—and are named after torrent releases. In reality, these are Windows executable files that don't play videos, but instead infect devices, according to Bitdefender analysts. The attackers deliberately alter the file icons to look like media player files. Due to Windows' default settings, the system hides file extensions, and many users are unable to distinguish an .exe file from a genuine video.

Once launched, the Lumma Stealer spyware collects a wealth of sensitive data that helps scammers withdraw funds from victims' crypto wallets: remote access credentials for cryptocurrency wallets, browser passwords, saved payment details, autofill data, and so on. Furthermore, the malware steals authentication cookies, which can cause victims to lose access to their crypto wallets and other payment service accounts even with two-factor authentication enabled.

Blockchain experts noted that the campaign almost exactly replicates the pattern from last year, when the same malware was disguised as counterfeit copies of the film "Mission: Impossible – Final Payback." Security experts noted that hackers regularly embed code to empty wallets into content that users attempt to download. The malware was distributed through fake CAPTCHA pages redirected through the BNB Chain, mobile apps, malicious phone wallpapers, and even special cryptocurrency-stealing code planted in Python developer libraries.

Amid a rise in phishing attacks, the analytics platform DefiLlama has postponed the release of its mobile app for iPhones. The project team took too long to get Apple to remove phishing apps masquerading as DefiLlama from the App Store.