Platformists hide harmful programs to exchange addresses in Microsoft Office additions

The harmful actors are trying to steal the encryption with the malicious programs included in the fake Microsoft Offices extensions that have been uploaded to Sounds Forge Source Forge, according to Kaspersky.

One of the harmful lists, called “Officepackage”, contains real additions to Microsoft Office but hide harmful programs called Clipbanker that replaces an encrypted porch address on a computer with the attacker’s address, Kaspersky’s Anti-Malware Research He said In April 8 report.

The team said: “Users of the encryption portfolio usually copy their addresses instead of writing them. If the device is infected with Clipbanker, the victim’s money will end in a completely unexpected place.”

The fake project page on Sourceforge mimics the legislative developer tool page, which shows the additional Office buttons and download buttons and can also appear in the search results.

Kaspersky said that another feature of the malware infection series includes sending infected device information such as IP addresses, American names and users’ names for infiltrators through Telegram.

Harmful programs can also wipe the affected system of already installed signs or to delete and delete viruses.

The attackers can sell access to the other regime

Kaspersky says that some of the files in the pseudo download are small, which raise “red flags, because office applications are never small, even when they are compressed.”

Other files are filled with Junk to persuade users that they are looking for an original software installer.

The company said the attackers secure an infected system “through multiple methods, including unconventional methods.”

“While the attack mainly targets the cryptocurrency by deploying a mine and Clipbanker worker, attackers can sell the system to the most dangerous actors.”

The interface is in Russian, which Kaspersky speculates that it is targeting Russian -speaking users.