A group of hackers is distributing a corrupted version of Windows 10 on torrent download platforms. The ISOs made available to Internet users actually contain malware so well designed that it escapes detection by the victims’ PC security software.
The cybersecurity company Doctor Web discovered a clipper malware, in several builds of Windows 10 distributed through torrent sites. According to the Cyber Dictionary, a clipper program is “a type of malicious software that hijacks a user’s clipboard and replaces its cryptographic address with the address of a hacker”.
To read – Cryptocurrencies: the Cinobi Trojan attacks digital wallets
To do this, cybercriminals use a Trojan called Trojan.Clipper.231, which has already allowed them to steal “an amount equivalent to approximately $19,000”. To deploy their malware, they use the PC’s UEFI partition of their victim to store the components to run the clipper malware. The malware runs during the mount phase of the EFI disk, before Windows starts.
Hackers install crypto-stealing malware in Windows 10
Hackers thus evade antivirus detection which, generally, do not analyze the files contained in this partition. At the end of this procedure, the clipper program starts monitoring the contents of the clipboard. If it is a crypto wallet address, the malware replaces it with one of the hackers’. The Internet user who thinks of making a transfer of virtual currency, all that is most banal, will in fact transfer his coins directly to the account of the pirates.
If you installed Windows through an ISO file from a torrent site such as Zone-Téléchargements, and its build number is in the following list, reformat your system and use an ISO from a source more safe :
- Windows 10 Pro 22H2 19045.2728 + Office 2021 x64 by BoJlIIIebnik RU.iso
- Windows 10 Pro 22H2 19045.2846 + Office 2021 x64 by BoJlIIIebnik RU.iso
- Windows 10 Pro 22H2 19045.2846 x64 by BoJlIIIebnik RU.iso
- Windows 10 Pro 22H2 19045.2913 + Office 2021 x64 by BoJlIIIebnik [RU, EN].iso
- Windows 10 Pro 22H2 19045.2913 x64 by BoJlIIIebnik [RU, EN].iso