Cybercrime Arrests, Bitget Heist and Malware Campaigns Lead OpenSourceMalware Show #23
Summary
The episode covers arrests linked to ShinyHunters and KillSec, a $351.6 million Bitget theft attributed to suspected North Korean hackers, signed Mac malware posing as Claude Desktop, malicious Baileys packages and PolinRider evasion changes.
Key points
- Dutch police arrested a suspected longtime ShinyHunters member; police separately arrested three suspected KillSec members. KillSec is linked to about 1,000 attacks.
- Suspected North Korean hackers stole $351.6 million from Bitget hot and warm wallets. SlowMist attributed initial access to a zero-day in an unnamed security product.
- A lookalike Claude Desktop site distributed a signed macOS installer with an added payload; the installer was about four times the size of the legitimate one. The episode said Apple had blocked the signing partner.
- More than 100 malicious npm packages abusing the Baileys WhatsApp library were reported. Most inflated channel follower counts, while some supported other attacks, including WhatsApp-based C2.
- PolinRider variants changed payload names, extensions and locations to evade detections relying on fixed filenames or paths.
Article Details
- Event Type
- Cybersecurity news roundup covering arrests of suspected cybercriminals, a cryptocurrency theft, and malware and software supply-chain campaigns.
- Impact
- Suspected hackers stole $351.6 million from Bitget’s hot and warm wallets, although customer accounts continued to display full balances. The roundup also describes a signed macOS installer carrying an added payload, more than 100 malicious npm packages—mostly used to inflate WhatsApp channel followers, with some supporting further attacks—and PolinRider changes intended to evade file-based detections. Police arrested Pepijn van der Stap, a ShinyHunters member, and three suspected KillSec members.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | claude-desktop[.]com | Lookalike site serving a signed macOS installer with an added malicious payload. |
People
Jenn GileDiscussed research into PolinRider’s changing fake-font filenames, locations, and file extensions.Paul McCartyDiscussed the malware and cybercrime reports and his research on detection engineering in GitHub.Pepijn van der StapArrested in the Netherlands; described as a long-time ShinyHunters member using the handle Umbreon.ReyA 16-year-old described as ShinyHunters’ leader; the discussion says he was presumed to be behind a later FBI hack, while noting blame was disputed.
Threat Actors
KillSecRansomware group linked in the discussion to roughly 1,000 attacks and the arrests of three suspected members.Pepijn van der StapDescribed as a long-time ShinyHunters member and suspected leader; uses the handle Umbreon.ReyDescribed as a 16-year-old ShinyHunters leader involved in a power struggle over infrastructure; the article says he was presumed to be behind a later FBI hack, but attribution was disputed.ShinyHuntersCybercrime group whose member Pepijn van der Stap was arrested; the article describes an internal power struggle over group infrastructure.UmbreonHandle used by Pepijn van der Stap, whom the article describes as a long-time ShinyHunters member.
Vendors
Products
Claude DesktopSigned Mac malware posing as Claude Desktop: A lookalike Claude Desktop site is serving a signed macOS installer hosted on GitHub. It appears to be the real app with a padded payload added. Because it’s signed, macOSGitHubposing as Claude Desktop: A lookalike Claude Desktop site is serving a signed macOS installer hosted on GitHub. It appears to be the real app with a padded payload added. Because it’s signed, macOS installs itmacOSSigned Mac malware posing as Claude Desktop: A lookalike Claude Desktop site is serving a signed macOS installer hosted on GitHub. It appears to be the real app with a padded payload added. Because it’s signed, macOSnpmBaileys campaign update: The number of malicious npm packages abusing the Baileys WhatsApp library now tops 100. Most only inflate follower counts for WhatsApp channels, so the direct risk is low. Some have also servedVS Codethe malware when it was, you know, force pushing into these repos, uh, you know, the tasks file in VS Code gets pushed up, and then the second thing is a top level folder that’s public/fonts, and that’s where allWhatsAppBaileys campaign update: The number of malicious npm packages abusing the Baileys WhatsApp library now tops 100. Most only inflate follower counts for WhatsApp channels, so the direct risk is low. Some have also served
Countries
Jordan[00:03:01] Paul McCarty: right. Amalgam. Yeah. And Rey is, you know, 16, so I’m not gonna say his name. Krebs is fully doxxed him, um- And, um, lives in Jordan and has taken over kind of…NetherlandsUm, it’s a little unclear if they really are or not, but they’re, uh, Dutch. They were arrested in the Netherlands. Uh, they were actually recently released from prison after serving three years. Uh, you know, uh,North KoreaNorth Korea steals $351.6M from BitgetRomaniaso three arrests. One is a 16-year-old from Spain. The other two are in their 20s, uh, from the UK and Romania. There’s a fourth person who was not arrested. Uh, sounds like probably the reason is he was a minor.Spain[00:06:08] Jenn Gile: Um, so three arrests. One is a 16-year-old from Spain. The other two are in their 20s, uh, from the UK and Romania. There’s a fourth person who was not arrested. Uh, sounds like probably the reasonUnited KingdomGile: Um, so three arrests. One is a 16-year-old from Spain. The other two are in their 20s, uh, from the UK and Romania. There’s a fourth person who was not arrested. Uh, sounds like probably the reason is he was a