🧐 How a hacker stole $1 million from a Binance account without hacking the account or 2FA

A new story of scam on the Internet from a Chinese user. A short summary from the victim’s words:

— On May 24, I was driving home from work, my computer and phone were with me.

“At that moment there was crazy trading going on in my account, but I didn’t know about it. QTUM/BTC is up 21% due to purchases from my account, DASH/BTC is up 27%, PYR/BTC is up 31%, NEO/USDC is up 22%.

— I knew nothing about these operations until, out of habit, I opened an account on Binance to see the price of BTC.

“I was subsequently informed by experts that a hacker had hacked my web page cookies and was manipulating asset prices from my account.

— The hacker, by manipulating asset prices from my account, earned money and successfully withdrew it from Binance. When I contacted support, the funds had already been withdrawn.

— The culprit of the attack is a Chrome extension called Aggr.

— The principle of the attack is this: if you install and use a malicious plugin, the hacker can collect your cookies on the hacker server, and from there use it to intercept active user sessions, pretending to be the user themselves.

- No more need to hack password or 2FA to control your account. Chrome web extensions can be just as harmful as downloading malicious apps.

#скам #Взлом