A complex and stealthy malware campaign dubbed CRPx0 is targeting MacOS and Windows systems, with potential Linux capabilities in development. The campaign begins with a social engineering lure offering free access to OnlyFans, aiming to trick users into downloading malicious files. This sophisticated operation involves cryptocurrency theft, large-scale data exfiltration, and ransomware deployment, based on information published by Security Week.The CRPx0 campaign, analyzed by Aryaka Threat Research Labs, uses a malicious zip file containing a shortcut that appears to lead to free OnlyFans accounts. Instead, it installs malware that steals cryptocurrency by monitoring and altering clipboard entries for wallet addresses. The attackers then exfiltrate selected data, including documents, media, emails, and code files, as part of a double extortion strategy. Following data theft, the malware encrypts targeted files with the .crpx0 extension, displays a "gotcha" image as the desktop wallpaper, and drops ransom notes in multiple languages. Victims are instructed to contact the attackers via various channels, including email, qTox, and Telegram.The campaign also operates a leaks site, claiming to have compromised 38 victims and leaked over 10,839 terabytes of data. Stolen data is offered for sale for $500 in cryptocurrency, granting lifetime access to current and future leaks. The campaign is described as a highly organized, multi-platform threat adaptable to escalating from opportunistic theft to large-scale data exfiltration and double extortion.Source: Security Week
