Ethereum Users Warned of Wallet-Stealing Malware in Swarm Software Supply Chain Attack - Hokanews

Blockchain security firm SlowMist identified a software supply chain attack targeting Ethersphere's Swarm distribution infrastructure, with malicious releases reportedly designed to steal cryptocurrency wallet credentials and compromise users' computers. The affected software is associated with Swarm, a decentralized storage network within the broader Ethereum ecosystem.

According to SlowMist's security alert, the malicious releases could expose sensitive wallet information and private keys across Windows, macOS, and Linux systems. Attackers gained access to GitHub accounts and abused legitimate software release processes to distribute the malware.

Smart Contract Malware

SlowMist's investigation found that the attackers incorporated Ethereum smart contracts into their malicious infrastructure. Rather than relying entirely on conventional centralized servers, the malware uses a smart contract as a decentralized configuration repository to retrieve command-and-control information.

Through the smart contract, attackers can remotely change the server addresses used by the malware without having to distribute another compromised software release. Researchers also identified connections between the infrastructure and two previously reported malware campaigns, SleepyDuck and EtherDuck.

Wallet Theft Risks

Further findings from independent security researchers at Socket and SafeDep revealed additional malicious tools targeting Swarm wallet files and cryptocurrency credentials. The identified malware was capable of collecting sensitive information and establishing persistent remote access to compromised computers.

This creates risks beyond the immediate theft of wallet credentials, as attackers could potentially maintain access to affected systems. The incident highlights the risks associated with trusted software distribution channels.

Recommended Actions

Following the discovery, SlowMist advised affected users to remove the compromised software package and reinstall the verified clean version 13.2.0. Users running Swarm Desktop v0.56.2 were separately instructed to upgrade to version v0.56.3.

Researchers have not established how many users were affected or confirmed the total financial losses resulting from the incident. The attack demonstrates how compromised developer accounts and software distribution infrastructure can expose cryptocurrency users to private-key theft and unauthorized access to their computers.