What you need to know
- Hackers are utilizing a fake version of KMSPico to spread Cryptbot malware to PCs.
- The authentic version of KMSPico is a tool used by pirates to bypass Windows and Office license requirements.
- The attack is particularly dangerous because using KMSPico often requires people to disable antimalware software.
A popular pirating tool is being imitated by malicious actors in an attempt to spread malware. According to a report by Red Canary from December 2, 2021, fake versions of KMSPico have been utilized to get malware onto PCs. If someone allows their system to be compromised by the fake software, the Cryptbot malware can steal credentials.
KMSPico is a tool used to circumvent license fees for Windows and Office. It uses Windows Key Management Services — a tool frequently used for legitimate reasons by enterprise clients — to fraudulently activate software.
Because KMSPico is used to pirate software, many antimalware tools flag it as a potentially unwanted program (PUP). Because of this, pirates will often disable security features to use KMSPico. This makes a fake version of the software is especially dangerous, as PC owners may have voluntarily left themselves defenseless.
Cryptbot can collect sensitive information from the following applications:
- Atomic cryptocurrency wallet
- Avast Secure web browser
- Brave browser
- Ledger Live cryptocurrency wallet
- Opera Web Browser
- Waves Client and Exchange cryptocurrency applications
- Coinomi cryptocurrency wallet
- Google Chrome web browser
- Jaxx Liberty cryptocurrency wallet
- Electron Cash cryptocurrency wallet
- Electrum cryptocurrency wallet
- Exodus cryptocurrency wallet
- Monero cryptocurrency wallet
- MultiBitHD cryptocurrency wallet
- Mozilla Firefox web browser
- CCleaner web browser
- Vivaldi web browser
Red Canary suggests that PC owners activate software through legitimate means. "A pirate's life is not the life for us, especially when it comes to cracked software. KMSPico is license-circumvention software that can be spoofed in a variety of ways, and in this case a malicious version led to an interesting Cryptbot infection designed to steal credentials." The report concludes by saying, "save yourself the trouble and go for legitimate, supported activation methods."
