Download.com Distributed Malware That Steals Bitcoins

The popular download site Download.com has been distributing malware for years that bitcoins from internet users have been stolen, anti-virus company ESET says today. The malware was hidden in bombarded applications called Disk Imager, Code :: Blocks and MinGW-w64.

The infected version of Disk Imager has been available on Download.com since May 2016 and was downloaded over 4500 times during that time. Code :: Blocks has been on Download.com since June 2016 and was removed from the website last year by Cnet, owner of Download.com. However, the program had already been downloaded 104,000 times. The number of downloads of MinGW-64, which was also on the website since 2016, amounted to just under 500.

The malware in the three programs was developed to steal bitcoins. Bitcoin users who want to make a payment or transfer money to another wallet often copy the wallet address of the beneficiary and then paste it into a field on the transaction page. At that moment the wallet address is in the clipboard of the computer.

The malware monitors the clipboard on infected computers and when it sees that a user is copying a wallet address, it changes this address. If the user then wants to paste the wallet address onto the transaction page, he will paste the custom wallet address and transfer money to the wrong party. The bitcoin address that the malware uses would have received a total of 8.8 bitcoin, which is currently 62,000 euros. After being informed, Cnet has removed the infected programs. It is not the first time that Download.com is in the news due to malware being offered.

Researcher Warns Of Software On Download.com

Download.com is a popular download site, but how secure is the software that is actually offered here?A researcher from How-To Geek decided the ten most popular programs from Download.com to install and startled by the result that he advises users not to repeat the experiment on their own computer. For the experiment, the programs were completely installed by default, as a typical user would do.

Download.com , which is part of CNet News, sets the policy that all downloads are offered free of adware, spyware or other malicious software. Many of the software appeared to be bundled with a variety of other programs. Via Download.com users can download the software directly, but there is also a Download.com -installer, which is much more apparent. This includes an installer that in addition to the desired program installs all sorts of other programs. It appears to include "browser hijackers" and fake "registry cleaners" to go.

Remarkably, the virus Avast is one of the first programs were installed and then some other downloads blocked because they were labeled as malicious. "Free software vendors to bundle earn almost all money through complete nonsense and scareware that mislead users to pay to clean up their PCs, regardless of the fact that you can avoid this by this" crappy "freeware nothing to install," says Lowell Heddings .

The experiment was repeated for several months and each time ended Heddings with other software on the computer. "Every software that unifies itself brings with it the same culprits: browser hijackers that hijack your search engine and home page and place ads everywhere because if the product is free, you are the real product.."