On October 30, numerous significant crypto platforms observed an influx of dangerous popups that encouraged users to link their wallets. Information about the unauthorized access originated from a supply chain attack on the widely used Lottie Player animations library. 

This JavaScript library which is used by popular websites including the ones run by Apple, Spotify, and Disney was manipulated to include a crypto-draining popup that targeted decentralized finance (DeFi) projects like 1inch and TEN Finance.

The details of the supply chain breach

LottieFiles’ GitHub account was attacked by obtaining a senior software engineer’s authentication data after which the attackers quickly released three updates containing malware in all. 

Consequently, any site or app incorporating the hacked version of Lottie Player flooded the users with popups that led them to the said Ace Drainer crypto drainer. This approach was a departure from those previous methods, as it was essentially serving users ads through their favourite and most reliable crypto applications as opposed to sending out phishing links on other apps.

Industry response and security recommendations

When the attack was identified, LottieFiles deleted the malicious update and advised application developers to update to either the safer 2.0.4 version or the most recent 2.0.8 version of the library. Engineering vice-president at LottieFiles Jawish Hameed corroborated these changes, reimbursing that the afflicted versions had been removed from GitHub repositories. 

Cybersecurity companies such as Wiz and Blockaid have discouraged users from relaxing, saying that some crypto websites may still show the malicious popup even when using the affected library versions.

Recently there has been growing use of trusted SLPs as attackers rely on them more often. Since the instances of scams and security breaches are on the increase, the platforms are encouraged to enhance the monitoring activities and include frequently updates to protect against other related threats in future.

Earn more PRC tokens by sharing this post. Copy and paste the URL below and share to friends, when they click and visit Parrot Coin website you earn: https://parrotcoin.net0

PRC Comment Policy

Your comments MUST BE constructive with vivid and clear suggestion relating to the post.

Your comments MUST NOT be less than 5 words.

Do NOT in any way copy/duplicate or transmit another members comment and paste to earn. Members who indulge themselves copying and duplicating comments, their earnings would be wiped out totally as a warning and Account deactivated if the user continue the act.

Parrot Coin does not pay for exclamatory comments Such as hahaha, nice one, wow, congrats, lmao, lol, etc are strictly forbidden and disallowed. Kindly adhere to this rule.

Constructive REPLY to comments is allowed