Procolored Printer Drivers Infected With Bitcoin-Stealing Malware, 9.3 BTC Stolen

Chinese printer manufacturer Procolored has been distributing Bitcoin-stealing malware alongside its official drivers, according to local media reports. The company, based in Shenzhen, used USB drivers to distribute malware-ridden drivers and uploaded the compromised software to cloud storage for global download. The malware operates by hijacking the wallet address in the user’s clipboard and replacing it with the attacker's address.

So far, 9.3 BTC worth over $953,000 have been stolen. The issue was first reported by YouTuber Cameron Coward, whose antivirus detected malware in the drivers while testing a Procolored UV printer. The antivirus flagged the drive as containing a worm and a trojan virus named Foxif.

When contacted, Procolored denied the claims and dismissed the antivirus flagging the drivers as a false positive. Coward turned to Reddit, where he shared the issue with cybersecurity professionals, attracting the attention of cybersecurity firm G-Data. G-Data’s investigation found that most of Procolored’s drivers were hosted on the file hosting service MEGA, with uploads as old as October 2023. Analysis of those files confirmed that they were compromised by two distinct pieces of malware: backdoor Win32.Backdoor.XRedRAT.A and a crypto-stealer designed to substitute addresses in the clipboard with those controlled by the attacker.

G-Data contacted Procolored, with the hardware producer saying it deleted the infected drivers from its storage on May 8 and re-scanned all files. Procolored attributed the malware to a supply chain compromise, stating that the malicious files were introduced through infected USB devices before being uploaded online.

This incident highlights the vulnerabilities in supply chain security and the potential for malware to be distributed through seemingly legitimate sources. It underscores the importance of vigilant cybersecurity practices and the need for continuous monitoring of software updates. Users who downloaded Procolored printer drivers in the past six months are advised to immediately perform a full system scan using antivirus software. Ideally, users should reinstall their operating system and thoroughly check old files.