Sneaky fake Google Translate app installs crypto miner on 112,000 PCsIssuing time:2022-09-01 18:52 Dressed up as legitimate desktop software, this sneaky malware has infected thousands of machines across 11 countries, forcing them to unknowingly mine Monero (XMR).
Crypto mining malware has been sneakily invading hundreds of thousands of computers around the world since 2019, often masquerading as legitimate programs such as Google Translate, new research has found. In a Monday report by Check Point Research (CPR), a research team for American-Israeli cybersecurity provider, Check Point Software Technologies revealed the malware has been flying under the radar for years, thanks partly to its insidious design which delays installing the crypto mining malware for weeks after the initial software download.
Linked to a Turkish-based-speaking software developer claiming to offer “free and safe software,” the malware program invades PCs through counterfeit desktop versions of popular apps such as YouTube Music, Google Translate and Microsoft Translate. Once a scheduled task mechanism triggers the malware installation process, it steadily goes through several steps over several days, ending with a stealth Monero (XMR) crypto mining operation being set up. The cybersecurity firm said that the Turkish-based crypto miner dubbed ‘Nitrokod’ has infected machines across 11 countries. According to CPR, popular software downloading sites like Softpedia and Uptodown had forgeries available under the publisher name Nitrokod INC. Some of the programs had been downloaded hundreds of thousands of times, such as the fake desktop version of Google Translate on Softpedia, which even had nearly a thousand reviews, averaging a star score of 9.3 out of 10, despite Google not having an official desktop version for that program. According to Check Point Software Technologies, offering a desktop version of apps is a key part of the scam. Most programs offered by Nitrokod do not have a desktop version, making the counterfeit software appealing to users who think they’ve found a program unavailable anywhere else. According to Maya Horowitz, vice president of research at Check Point Software, the malware-riddled fakes are also available “by a simple web search.” “What’s most interesting to me is the fact that the malicious software is so popular, yet went under the radar for so long.” As of writing, Nitrokod’s imitation Google Translate Desktop program remains one of the main search results. Design helps avoid detectionThe malware is particularly tricky to detect, as even when a user launches the sham software, they remain none the wiser as the fake apps can also mimic the same functions that the legitimate app provides. Most of the hacker’s programs are easily built from the official web pages using a Chromium-based framework, allowing them to spread functional programs loaded with malware without developing them from the ground up. |
