Topic
Ethereum
Mercado Bitcoin Freezes $11 Million After Hacker Drains Hot Wallets Across Multiple Chains
Crypto & Financial Crime
EIP-7702 Explained: How Ethereum's New Signature Standard Enables Persistent Wallet Delegation Attacks
Crypto & Financial Crime
AI Agent with AWS Credentials Seeks Entry to DN42 Amateur Network and Accumulates $6531 Bill
AI SecurityAddress Substitution Attacks Exploit Partial Address Checks in Crypto Wallets
Address poisoning, clipboard hijackers, and supply-chain malware all rely on users verifying only the first and last few characters of long blockchain addresses. Researchers detail real incidents including a May 2024 theft of 1,155 WBTC worth roughly 68 million dollars where an attacker poisoned transaction history after a test transfer. Studies from Carnegie Mellon University show that even security-conscious users miss mismatches in truncated addresses 21 to 38 percent of the time. Existing identicons such as Jazzicon and Blockies can be matched by attackers because they depend on only the first eight hex characters. The team released the open-source Humanized Hash library that renders any address or hash as a 4x4 grid of colored shapes using PBKDF2 stretching, making forgery computationally expensive. Calculations indicate that matching both the visual pattern and edge characters requires tens to millions of GPU-years on current hardware. The library supports multiple languages with identical output and carries an MIT license with a fixed algorithm.
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens in Brazil
Elastic Security Labs researchers have detailed the operations of the KREMLIN banking malware, tracked under the identifier REF9334, which targets Chrome and Edge browsers to harvest credentials and session tokens. The campaign focuses almost exclusively on Brazil, with 98 percent of the 1,515 identified infections located in the country and impersonating a dozen Brazilian banks. Infection begins with multi-stage JavaScript loaders disguised as banking documents, invoices, or corporate papers that require manual execution by the victim. The loaders then deploy C++ installers and malicious browser extensions that modify the Secure Preferences file, enable developer mode, and overwrite protection objects with forged metadata using a technique called Phantom Extension. Once active, the extension collects session tokens, cookies, sessionStorage and localStorage data, 15 days of browsing history, screenshots, open tab information, and full HTML of visited pages. The operation has run since May 2025 across seven distinct campaigns and began using Ethereum smart contracts for infrastructure on 19 May 2026.
Dysphoria Botnet Compromises Nearly 300,000 Devices for DDoS Attacks and Residential Proxy Services
The Dysphoria botnet has infected approximately 296,000 devices, including routers, IP cameras, gateways, and embedded Linux systems. Researchers first observed the threat in the first quarter of 2026, noting rapid evolution from the jackskid and fbot families. The infrastructure is primarily used for DDoS attacks but has expanded to offer residential proxy capabilities. Infection occurs through brute-force attacks on Telnet and SSH services with weak credentials, as well as known remote code execution vulnerabilities in IoT equipment. A key technical advancement involves the use of Ethereum and Solana blockchain domains for command-and-control infrastructure, making takedowns significantly harder. Compromised devices can also function as relays by leveraging UPnP to expose ports and hide criminal traffic origins. Operators advertise attack capacity of up to 4 Tbps and sell DDoS services in structured commercial packages targeting internet services and gaming platforms worldwide.