Ethical Hacking News
Hackers Compromise Ethersphere's bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware. In a shocking turn of events, hackers have managed to compromise two popular tools developed by Ethersphere, a project that aims to bring blockchain technology to a wider audience. The compromised tools, bee-js and Swarm Desktop, are used for various tasks, including the creation and management of decentralized storage networks. Unfortunately, hackers have used these tools to deliver malware that can steal the wallet key and stored password of Swarm Desktop users, resulting in a significant security breach. The incident highlights the importance of software security and the need for developers to prioritize the security of their tools and applications.
Hackers compromised two popular tools, bee-js and Swarm Desktop, developed by Ethersphere, using a vulnerability in their release automation system. The hackers published malicious versions of the tools, which were then downloaded and run by users, resulting in a significant security breach. The malware stolen wallet keys and passwords, installing a backdoor on Windows, macOS, and Linux machines, and allowing the attackers to gain unauthorized access. The attack highlighted the importance of software security, the need for developers to prioritize security, and the need for regular code review and testing. The incident also raised questions about software supply chain security, emphasizing the need for careful review of code and artifacts used in the software development process.
In a shocking turn of events, hackers have managed to compromise two popular tools developed by Ethersphere, a project that aims to bring blockchain technology to a wider audience. The compromised tools, bee-js and Swarm Desktop, are used for various tasks, including the creation and management of decentralized storage networks. Unfortunately, hackers have used these tools to deliver malware that can steal the wallet key and stored password of Swarm Desktop users, resulting in a significant security breach.
The hackers exploited a vulnerability in Ethersphere's release automation system, which is used to publish new versions of their tools. The attackers used this vulnerability to publish malicious versions of bee-js 13.3.0 and Swarm Desktop 0.56.2, which were then downloaded and run by users. The malware, which was designed to steal wallet keys and passwords, was able to install a backdoor on Windows, macOS, and Linux machines, allowing the attackers to gain unauthorized access to the compromised systems.
The malware works by searching for specific files in the Swarm Desktop data folder and sending them to the attackers' server. The attackers were able to use the stolen wallet keys and passwords to access the users' wallets and steal their funds. The malware also installed a backdoor on the compromised systems, allowing the attackers to gain access to the system and steal sensitive information.
The hackers also used the compromised tools to install a ScreenConnect remote-access client, which allowed them to remotely access the compromised systems. The client was signed by its maker, ConnectWise, and was designed to run as a system service. However, the hackers were able to exploit a vulnerability in the client's code and use it to gain unauthorized access to the system.
The attack was discovered when users began to report issues with their Swarm Desktop applications. Ethersphere's maintainers quickly responded to the issue and published a clean release of Swarm Desktop, which was free from the malware. However, the attack highlighted the importance of software security and the need for developers to prioritize the security of their tools and applications.
The incident has also raised questions about the security of the open-source software development process. Ethersphere's release automation system, which was used by the hackers, is designed to publish new versions of their tools automatically. However, the attackers were able to exploit a vulnerability in the system's code and use it to publish malicious versions of their tools. This highlights the need for developers to regularly review and test their code to ensure that it is secure.
In the aftermath of the attack, Ethersphere's maintainers have taken steps to improve the security of their tools and applications. They have increased the security of their release automation system and have implemented new measures to prevent similar attacks in the future. However, the incident highlights the need for developers and users to remain vigilant and take steps to protect themselves against cyber threats.
The incident also highlights the importance of software supply chain security. The hackers exploited a vulnerability in Ethersphere's release automation system, which was designed to publish new versions of their tools. The attackers were able to use this vulnerability to publish malicious versions of their tools, which were then downloaded and run by users. This highlights the need for developers and users to carefully review the code and artifacts used in the software development process.
In conclusion, the compromise of Ethersphere's bee-js and Swarm Desktop by hackers has highlighted the importance of software security and the need for developers to prioritize the security of their tools and applications. The attack has also raised questions about the security of the open-source software development process and the importance of software supply chain security.
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Compromise-Etherspheres-bee-js-and-Swarm-Desktop-to-Deliver-Wallet-Stealing-Malware-ehn.shtml
https://thehackernews.com/2026/11/hackers-compromise-etherspheres-bee-js.html
Published: Mon Nov 9 13:44:12 2026 by llama3.2 3B Q4_K_M
