Sirius Backdoor and Armorsteal Malware Campaigns Target Cryptocurrency Users

• •Sirius Backdoor uses FedEx-themed phishing to deliver malware via PowerShell scripts.
• •Armorsteal malware exploits SEO poisoning to install malicious Python modules.
• •Both malware strains target cryptocurrency users, stealing sensitive information.

Broadcom's Trellix and Zscaler researchers reported two distinct malware campaigns targeting cryptocurrency users. The Sirius Backdoor, a C++ malware, is distributed via spear-phishing emails disguised as FedEx messages, leading victims to execute a malicious PowerShell script. This malware enables extensive remote access and espionage capabilities, including credential theft and clipboard manipulation. The Armorsteal malware, spread through SEO poisoning, tricks users into running a rogue PowerShell script that installs malicious Python modules. Armorsteal also captures sensitive data, including passwords and cryptocurrency wallet information. Both malware strains utilize sophisticated techniques to evade detection and exploit user trust. Symantec products are equipped to block these threats, and users are advised to implement strict security measures.