{"id":48249,"date":"2022-08-31T20:09:09","date_gmt":"2022-08-31T20:09:09","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/crypto-crooks-trojanized-google-translate-app-watering-hole-attack"},"modified":"2022-08-31T20:09:09","modified_gmt":"2022-08-31T20:09:09","slug":"crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/","title":{"rendered":"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt8f27e07616d06e26\/630fc187a215667ce2f0e998\/wateringhole-Robert-Harding-Alamy.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>A cryptomining campaign has potentially infected thousands of machines worldwide by hiding in a Google Translate download for desktops.<\/p>\n<p>According to researchers at Check Point, the threat actor behind it is a Turkish-speaking software developer called Nitrokod, which offers free versions of popular software applications that don&#8217;t have an official desktop version \u2014&nbsp;like Google Translate.<\/p>\n<p>In fact, its version of the translation utility, created using the official Google Translate webpages and a Chromium-based framework, is its most popular offering, researchers said in a <a href=\"https:\/\/research.checkpoint.com\/2022\/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications\/\" target=\"_blank\" rel=\"noopener\">blog post<\/a> this week. It&#8217;s distributed in a watering-hole approach, available via websites like Softpedia and uptodown, and turning up at the top of search results for \u201cGoogle Translate desktop download.&#8221;<\/p>\n<p>Unfortunately, the downloads are Trojanized, which victims might not realize for a very long time (or ever) given that the app actually works as advertised. <\/p>\n<p>&#8220;This campaign highlights the diverse methods of propagation employed by cryptojacking groups,&#8221; says Matt Muir, security researcher at Cado Security. &#8220;Although masquerading as legitimate applications is as old as malware itself \u2026 sadly, it remains far too easy to trick an end user into installing what they believe to be a popular application.&#8221;<\/p>\n<h2 class=\"regular-text\">Built for Stealth<\/h2>\n<p>The campaign, which is ongoing and spreading globally, sports several features that are designed to help it remain undetected, Check Point researchers found.<\/p>\n<p>For instance, after the software is installed, the infection process goes dormant for weeks. Tom Kellermann, senior vice president of cyber-strategy at Contrast Security, tells Dark Reading that this is a prime example of a growing trend.<\/p>\n<p>&#8220;Notably, after initial injection they are waiting weeks to remain undetected,&#8221; he says. &#8220;Placing malware on a sleep cycle is becoming mainstream, and &#8216;chronos&#8217; attacks are growing where adversaries use time for the purposes of evasion.&#8221;<\/p>\n<p>After the sleep interval, the infection process is initiated and the victim receives an updated file that, over the course of a few days, loads a chained series of four droppers onto the machine. Finally, the last dropper fetches the Monero-focused XMRig cryptominer and executes it. <\/p>\n<p>The download then connects out to a command-and-control (C2) server for configuration data and begins mining,&nbsp;while the attackers delete any evidence of the infection process. Meanwhile, Google Translate will continue to work properly, separately \u2014&nbsp;offering no red flags for analysis.<\/p>\n<p>&#8220;This allowed the campaign to successfully operate under the radar for years,&#8221; according to Check Point&#8217;s analysis. &#8220;This way, the first stages of the campaign are separated from the ones that follow, making it very hard to trace the source of the infection chain and block the initial infected applications.&#8221;<\/p>\n<p>Active since 2019, Nitrokod claims to offer free and safe software, which&nbsp;in reality are all threats, researchers noted. The behaviors are similar to the Google Translate campaign in all other infected programs, they said. Thus, while this campaign was spotted in July, it&#8217;s likely that there will be additional activity from the cybercrime group going forward.<\/p>\n<h2 class=\"regular-text\">How to Protect Against Cryptomining<\/h2>\n<p>Assaf Morag, lead data analyst on the Aqua Nautilus research team, notes that the campaign illustrates how cryptojacking crooks are <a href=\"https:\/\/www.darkreading.com\/cloud\/attackers-fighting-over-cloud-workloads-for-cryptomining\" target=\"_blank\" rel=\"noopener\">proliferating their attack methods<\/a> and continuing to go after virtual coins as a quick financial win.<\/p>\n<p>In addition to Trojanized applications, &#8220;some cryptominers are hidden in websites, and when an unsuspecting victim browses the site, the cryptomining script on the website is running in the browser, often without users&#8217; knowledge or consent,&#8221; he says. &#8220;Another type of cryptojacking that we&#8217;ve seen recently is often more complex. It involves a large botnet infrastructure that scans for vulnerabilities and misconfigurations, exploits them, and disseminates the cryptojacking malware and often other malware aimed to expand the attack and make it persistent.&#8221;<\/p>\n<p>As a result, businesses should shore up their basic defenses such as patching and Web filtering, and implement policies against downloading anything but approved software onto endpoints, network sensors, servers, and firewalls. And even then, users should only download software from official repositories&nbsp;\u2014 like Google Play, in this case; if there&#8217;s no official desktop app, users should&nbsp;make do with the Web-based version. <\/p>\n<p>Michael Clark, director of threat research at Sysdig, also says the campaign puts remote workers on notice.<\/p>\n<p>&#8220;The software it pretends to be something that could be used by anyone,&#8221; he says. &#8220;It shows that your endpoints and even users at home could be affected by cryptomining. Endpoints may not be as powerful as servers, but for a cryptominer, every bit of processing power they can steal adds to their profits.&#8221; <\/p>\n<p>And what if it&#8217;s too late? If infected, &#8220;users will see a performance issue with their systems and potentially need a fresh install of their operating system to rid the system of the malware effectively,&#8221; says James McQuiggan, security awareness advocate at KnowBe4.<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/crypto-crooks-trojanized-google-translate-app-watering-hole-attack\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The ongoing campaign is spreading worldwide, using the lure of a fully functional Google Translate application for desktops that has helped the threat stay undetected for months.Read More <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/crypto-crooks-trojanized-google-translate-app-watering-hole-attack\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-48249","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-31T20:09:09+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt8f27e07616d06e26\/630fc187a215667ce2f0e998\/wateringhole-Robert-Harding-Alamy.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack\",\"datePublished\":\"2022-08-31T20:09:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/\"},\"wordCount\":808,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt8f27e07616d06e26\\\/630fc187a215667ce2f0e998\\\/wateringhole-Robert-Harding-Alamy.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/\",\"name\":\"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt8f27e07616d06e26\\\/630fc187a215667ce2f0e998\\\/wateringhole-Robert-Harding-Alamy.jpg\",\"datePublished\":\"2022-08-31T20:09:09+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt8f27e07616d06e26\\\/630fc187a215667ce2f0e998\\\/wateringhole-Robert-Harding-Alamy.jpg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt8f27e07616d06e26\\\/630fc187a215667ce2f0e998\\\/wateringhole-Robert-Harding-Alamy.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/","og_locale":"en_US","og_type":"article","og_title":"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-08-31T20:09:09+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt8f27e07616d06e26\/630fc187a215667ce2f0e998\/wateringhole-Robert-Harding-Alamy.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack","datePublished":"2022-08-31T20:09:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/"},"wordCount":808,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt8f27e07616d06e26\/630fc187a215667ce2f0e998\/wateringhole-Robert-Harding-Alamy.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/","url":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/","name":"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt8f27e07616d06e26\/630fc187a215667ce2f0e998\/wateringhole-Robert-Harding-Alamy.jpg","datePublished":"2022-08-31T20:09:09+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt8f27e07616d06e26\/630fc187a215667ce2f0e998\/wateringhole-Robert-Harding-Alamy.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt8f27e07616d06e26\/630fc187a215667ce2f0e998\/wateringhole-Robert-Harding-Alamy.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/crypto-crooks-spread-trojanized-google-translate-app-in-watering-hole-attack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/48249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=48249"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/48249\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=48249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=48249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=48249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}