Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

Hackers compromised the Ethersphere project's bee-js and Swarm Desktop tools by using the project's release automation to publish malicious versions. The malicious versions of bee-js 13.3.0 and Swarm Desktop 0.56.2 download and run code designed to steal wallet keys and passwords, then install backdoors on Windows, macOS, and Linux machines.

The malicious releases were taken down, and a clean Swarm Desktop update was released. However, no action was taken to remove a backdoor already installed or protect a key that had already been sent. No theft of funds was reported at the time of writing. The malicious releases appeared on GitHub and were withdrawn shortly after.

Both downloads reached around 65 by 08:27 UTC. The malicious code runs as a postinstall script executed automatically during installation unless install scripts are disabled. The downloaded code looks for two files in Swarm Desktop's data folder and sends them to the attackers' server if both are present. The attackers also install a backdoor on Linux and macOS machines, which runs in the background as a user service or as a LaunchAgent.

The backdoor allows attackers to take the node wallet's funds and install the client silently. The maintainers have since made the app's signing jobs wait for approval and run only from the main branch.