Ace Drainer Hack:加密应用遭恶意弹窗侵袭，安全警报升级

On October 30, the front-end websites of various online crypto apps fell victim to a security breach. This incident occurred after attackers managed to inject harmful code into an update of a widely-used animation library. As a result, decentralized finance apps such as 1inch and TEN Finance displayed pop-ups prompting users to connect their wallets, which were actually linked to a crypto-draining malware known as "Ace Drainer." This information was shared by Blockaid, a crypto security platform, in an October 30 post.

1. The security lead at cybersecurity firm Wiz, Gal Nagli, explained that the compromise was the result of a significant supply chain attack on the Lottie Player library. This library is immensely popular, providing animations for numerous sites and apps, and is used by major companies like Apple, Spotify, and Disney.

2. The attack was unusual in that it introduced a malicious pop-up into an otherwise seemingly secure website. Traditionally, attackers compromise high-profile social media accounts to deceive followers into clicking on phishing links on fake websites.

3. Jawish Hameed, the engineering vice president at LottieFiles—the company that publishes the animation library—confirmed on GitHub that the compromised library versions had been taken down and urged users to update to the latest version. He also mentioned that the attackers had gained access to the GitHub account of a LottieFiles' senior software engineer and pushed three malicious updates within a three-hour period. Additionally, he stated that the company had revoked access to the compromised account.

Wiz's Nagli reported that users were encountering the malicious crypto wallet connection pop-up on numerous popular websites across the internet. He speculated that the original intent of the attack might have been to target major crypto websites that utilize the library. Nagli also cautioned that websites still using the affected library versions could remain vulnerable. He advised users to verify if the sites are using the non-malicious packages, either version 2.0.4 or the latest 2.0.8.

In response to this incident, LottieFiles did not immediately provide a public statement.