Remove CryptoAITools trojan

CryptoAITools is a malicious Python package, disguised as a cryptocurrency trading tool. The malware initiates immediately upon installation and steals an extensive amount of data. Both Windows and macOS devices can be affected as there are two versions. CryptoAITools is a very dangerous piece of malware, and infection can have serious consequences.

 

 

The malicious Python package CryptoAITools has been distributed in two ways, through Python Package Index (PyPI) and GitHub. The malware was disguised as a cryptocurrency trading tool.

When successfully initiated on a device, the malware first determines which operating system the device is running in order to execute the correct version of the malware. Interestingly, the malware tries to distract users by presenting an interactive interface that makes it seem like it’s a legitimate cryptocurrency trading platform. While users are distracted, the malware performs extensive data theft in the background.

The malware steals the following data: Internet cookies, browsing history, saved log-in credentials, and a lot of data related to crypto wallets and crypto browser extensions. Among CryptoAITools’ main crypto targets are Bitcoin, Ethereum, Exodus, and Electrum. What’s more, the malware can steal files from Downloads, Documents, and Desktop folders. It mainly tries to steal files that may have financial data, passwords, or any other relevant information. When operating on a device running macOS, CryptoAITools tries to access data from Apple Notes and Stickies applications. Essentially, CryptoAITools aims to steal all information that has anything to do with cryptocurrencies in order to steal as many funds as possible.

What’s more, the malware can acquire more features by downloading payloads from sources under the control of the malicious actors. It’s likely that in the future, the malware will have even more features.

One of the most alarming things about this malware is the fact that users may not even notice it operating on the device. It poses as a legitimate cryptocurrency trading platform and even has certain functionality. Thus, users will not necessarily notice anything amiss. The malware is detected by many good anti-virus programs, and this highlights the importance of having an anti-virus program installed on the computer.

How did the CryptoAITools trojan infect a computer?

There are two main ways the CryptoAITools trojan has been noticed to infect users’ devices. Through GitHub and PyPI.

The CryptoAITools trojan was advertised on PyPI as a cryptocurrency trading tool, and while it has since been removed, it was downloaded over 1,300 times.

On GitHub, CryptoAITools trojan was promoted as a AI-powered bot that does real-time trades of meme tokens on the Solana network, called “Meme Token Hunter Bot”. The malicious actors had semi-active presence of GitHub in order to trick users into thinking it was legitimate. Fake support channels on Telegram were also advertised to create the image that it’s legitimate.

These are the two identified methods of distribution for CryptoAITools trojan. However, that does not mean that cybercriminals are not promoting it in different ways, or that they won’t in the future. Common malware distribution methods include malicious emails, torrents, drive-by downloads, malicious links, questioable download sources, online scams, fake updates, software cracks, and much more.

An effective way to avoid malware is to develop good online habits. That means being very careful with unsolicited emails with attachments, not clicking on random links, not using software cracks, avoiding pirating copyrighted content, and becoming familiar with common scams and malware distribution methods in more detail.

Remove CryptoAITools trojan

CryptoAITools trojan is a very serious and sophisticated infection. If an anti-malware program that detects it is not installed on the device, users might not even realize that it’s present on their devices. If you realize that you have downloaded the CryptoAITools trojan thinking it’s a cryptotrading platform or a bot that does real-time trades, install an anti-malware program and scan your computer immediately. If the infection is detected, remove CryptoAITools trojan.

If your device was infected, there’s a very strong chance that it was able to steal a lot of data related to your crytocurrencies and all accounts. You need to secure all your accounts immediately to make sure your funds are not stolen.

CryptoAITools is detected as:

• FileRepMalware by AVG/Avast
• Trojan.GenericKD.74544019 by BitDefender
• Spyware.CoinStealer.Python by Malwarebytes
• A Variant Of Generik.HQYOKDF by ESET
• Trojan.Gen.MBT by Symantec