Cryptocurrency

<h4><strong><a href="https://opentip.kaspersky.com/detankzone.com" target="_blank" rel="noopener noreferrer nofollow">The game</a>, named <em>DeTankZone</em> or <em>DeTankWar</em>, was designed to trick users into downloading malware and steal their cryptocurrency. </strong></h4>
<p>The hackers used a security hole in Google Chrome to install spyware that stole users’ wallet credentials.</p>
<h5><strong>The Fake Game Trap</strong></h5>
<p>The Lazarus Group didn’t cut corners with this scam. They created a fully playable, multiplayer online battle game where players could use non-fungible tokens (NFTs) as tanks in a global competition.</p>
<p>The game was promoted on social media platforms like LinkedIn and X (formerly Twitter). On the surface, it looked just like a fun blockchain game where you could “play-to-earn” rewards. But underneath, it was a trap waiting to be sprung.</p>
<blockquote class="twitter-tweet">
 <p dir="ltr" lang="en">Lazarus APT Hackers Exploit Chrome Zero-Day via Cryptocurrency Game: <a href="https://t.co/nrYuoA8qen" rel="noopener noreferrer nofollow">https://t.co/nrYuoA8qen</a></p>
 <p>The Lazarus APT group exploited a zero-day vulnerability (CVE-2024-4947) in Google Chrome through a cryptocurrency-themed game on detankzone[.]com, detected by Kaspersky on May 13, 2024.…</p>
 <p>— securityrss.ai (@securityRSS) <a href="https://twitter.com/securityRSS/status/1849202938800926932?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 23, 2024</a></p>
</blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<p>Here’s where the trouble began. The hackers used a <a href="https://securelist.com/lazarus-apt-steals-crypto-with-a-tank-game/114282/" target="_blank" rel="noopener noreferrer nofollow">“zero-day” vulnerability</a> in Google Chrome. A zero-day vulnerability is a flaw that hasn’t been discovered by the software maker, so there’s no immediate fix. In this case, the flaw allowed the hackers to infect users’ devices just by visiting the game’s website—no download needed! They used a type of malware called <em>Manuscrypt</em>, which helped them steal information like wallet passwords.</p>
<p>Even though Microsoft Security first <a href="https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/" target="_blank" rel="noopener noreferrer nofollow">noticed</a> the scam back in February 2024, the hackers removed the exploit before cybersecurity experts could fully analyze it. Still, Kaspersky Labs noticed more suspicious activity in May, and they alerted Google. The company quickly got to work and patched up the security hole in just 12 days.</p>
<h3 id="how-the-hackers-pulled-it-off">How the Hackers Pulled It Off</h3>
<p>The Lazarus Group modeled their fake game after an existing game called <em>DeFiTankLand</em>. By creating a look-alike game, they managed to fool people into trusting it. Even worse, their game didn’t just target people who downloaded it—it infected users just by visiting the website.</p>
<blockquote class="twitter-tweet">
 <p dir="ltr" lang="en">Microsoft has newly discovered that <a href="https://twitter.com/hashtag/DPRK?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#DPRK</a>‘s Moonstone Sleet is using a malicious tank game it developed called DeTankWar (also known as DeFiTankWar, DeTankZone or TankWarsZone) to infect devices.<a href="https://twitter.com/hashtag/Lazarus?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Lazarus</a> <a href="https://t.co/L7cksYYtTZ" rel="noopener noreferrer nofollow">https://t.co/L7cksYYtTZ</a></p>
 <p>— myp0cket.eth (@MyP0cket) <a href="https://twitter.com/MyP0cket/status/1795649124060266931?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 29, 2024</a></p>
</blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<p>The Lazarus Group used something called a “type confusion bug” in Chrome’s JavaScript engine, known as V8. Hackers found the seventh zero-day vulnerability in Chrome in 2024 alone. This clearly shows that hackers can catch even big companies like Google off guard.</p>
<div class="mb-2 flex gap-3 empty:hidden -ml-2">
 <div class="items-center justify-start rounded-xl p-1 flex">
  <div class="flex items-center">
   <div class="flex items-center pb-0"></div>
  </div>
 </div>
</div>
<p><a href="https://www.patreon.com/altcoinbuzz" target="_blank" rel="noopener noreferrer nofollow"><img decoding="async" src="https://www.altcoinbuzz.io/wp-content/uploads/2023/09/Alpha_website_leaderboard-banner.jpg"></a></p>
<div class="youtube-embed" data-video_id="GAAU0ACtFi8"><iframe title="BIGGEST Crypto Whale Accumulation! Sol Sui Big Move Ready!" width="696" height="392" src="https://www.youtube.com/embed/GAAU0ACtFi8?feature=oembed&amp;enablejsapi=1" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
</div>
<h6><strong>Disclaimer</strong></h6>
<p>The information discussed by Altcoin Buzz is not financial advice. This is for educational, entertainment, and informational purposes only. Any information or strategies are thoughts and opinions relevant to the accepted risk tolerance levels of the writer/reviewers and their risk tolerance may be different than yours. We are not responsible for any losses you may incur due to any investments directly or indirectly related to the information provided. Bitcoin and other cryptocurrencies are high-risk investments so please do your due diligence. Copyright Altcoin Buzz Pte Ltd.</p>
<p>The post <a href="https://www.altcoinbuzz.io/cryptocurrency-news/north-korean-hackers-use-fake-nft-game-to-steal-crypto/" rel="noopener noreferrer nofollow">North Korean Hackers Use Fake NFT Game to Steal Crypto</a> appeared first on <a href="https://www.altcoinbuzz.io" rel="noopener noreferrer nofollow">Altcoin Buzz</a>.</p>

North Korean Hackers Use Fake NFT Game to Steal Crypto

Table of Contents

Altcoin Buzz

Other articles published on Oct 24, 2024

Puffer Finance Reveals Puffer DAO, $PUFFER Coin and $vePUFFER NFT

Ripple CEO Brad Garlinghouse De-Banked Amid SEC Lawsuit and Regulatory Pressure

Solana’s Revenue Growth Elevates Market Position

Tron (TRX) and Dogecoin (DOGE) Pump, Cybro’s Presale Explodes: Is This a Leading Indicator of Bro...

Paxos Launches Yield Bearing Wrapped $USDL on Injective

South Korea’s Bithumb Faces Criticism for Unclear Opt-In Fee Waiver Campaign

Join our free newsletter for daily crypto updates!