“ZeusMiner” Phishing E-mail Contains Malicious Javascript File

Apparently there is a phishing mail going around, claiming to be coming from Scrypt ASIC Mining hardware company ZeusMiner. I wonder if it has to do with the recent store credit they gave out, allowing people to purchase hardware at a big discount?

Or maybe the phishers are after something different entirely. In these ZeusMiner phishing emails, there is, allegedly, a .jar file attached. Assuming this file will execute some strange JavaScript code, it’s hard to tell what the consequences will be.

I do believe that, if they were after your ZeusMiner login and password, it would be far easier to just create a fake website appearing to be the real deal. Javascript seems an odd choice to attach to these emails, don’t you think?

Or maybe these Javascript files can somehow start up a second version of your mining software, steal half of your hashpower and point it to a different pool. That sounds more plausible, but I’m not sure if it’s actually possible.

“Hi dear miner friend,

We have noticed recently some phishing attempt against support emails around crytocurrency. Please be aware of any file with file extension “jar” you get from email, please do not open any files extensions that are not PDF/JPG/PNG even it seems to be sent from us. Thank you.

Have a nice day!“

Thanks to ZeusMiner for letting us know about this issue!