I am writing to report a serious security incident that occurred while using Rhino 8, which resulted in a total compromise of my cryptocurrency wallet. I am seeking technical insights to understand the attack vector and to warn other users.
Incident Description:
While working on a Rhino file, a component or prompt related to KaroroCAM appeared on my screen. I had not intentionally downloaded or installed this plugin. Upon a single interaction with this prompt, my system’s security was compromised.
Impact:
Minutes after the incident, my browser-based cryptocurrency wallet was drained. The funds were sent to the following address: 0x03fDAb8A3A54467Ea00208c02BceeA9dAA40a729.
The transaction hash is: 0x1f20e9cbeaa2ac06bafb4483ffccc35cbe330bb9939f7f2ac1a6ad61a1b07d5f.
Technical Questions for the Experts:
File-Based Execution: Can a .3dm file be crafted to trigger the automatic loading or “silent” installation of a plugin (like an RHP file) from a remote or hidden local source?
KaroroCAM Integrity: Is there a known “spoofed” or malicious version of KaroroCAM circulating that targets Rhino users?
Sandbox/Isolation: Does Rhino 8 have mechanisms to prevent a plugin from accessing browser data (cookies/local storage) where wallet credentials might be stored?
Malicious RHP Behavior: Has the team seen cases where malicious RHP files act as “Infostealers”?
Transparency Note:
I must clarify that I was using an unauthorized copy of Rhino 8. I understand this likely introduced the vulnerability. However, I am sharing this to determine if the “KaroroCAM” element is a known malicious package or if the Rhino plugin system itself was used as the delivery mechanism.
If any developer or security researcher is interested in analyzing the Rhino file or the logs, I am more than happy to provide them privately.
Thank you for your time and any technical guidance you can provide.
So, I just recieved this email on my KaroroCAM email address:
Dear KaroroCAM Team,
I hope this email finds you well.
I am writing to you with complete respect for your work and development team to kindly ask for your technical guidance regarding a serious security incident that recently occurred on my system.
Please allow me to emphasize upfront that I am in no way accusing KaroroCAM or your team of malicious intent. On the contrary, I believe a malicious actor may have abused or impersonated the name of KaroroCAM—possibly by embedding an unauthorized script or trojan within a shared Rhino file or an illegitimate package—in order to compromise users’ machines.
Recently, while opening a Rhino file on my computer, a prompt related to KaroroCAM appeared unexpectedly, despite me not having intentionally installed it. Shortly after interacting with it, my cryptocurrency wallet was breached and drained of my life savings.
Given your intimate knowledge of Rhino’s plugin ecosystem and the genuine KaroroCAM architecture, I would be deeply grateful for your insights on:
Whether you have observed any recent cases of bad actors impersonating KaroroCAM or abusing Rhino’s package/plugin loading mechanism to distribute malware.
How a Rhino file might trigger or execute an external component or script without the user’s explicit prior installation.
Any recommended steps or technical indicators I should examine to analyze the suspicious file/process.
I am fully prepared to share file samples, hashes, system logs, or transaction details in private if that could help determine whether your legitimate software is being spoofed by attackers.
Thank you very much for your time, consideration, and any assistance or advice you can offer.
Sincerely,
With just this to go on I’m getting very heavy Phishing vibes - I have however asked for further information.
Hi @kiteboardshaper
I’m not saying that I’m a 100% sure, that this is a scam, but that email has AI written all over it! The formulaic wording and the fact that he sounds surprisingly composed, having just lost his entire life savings, makes it sound like a scam. If I’d lost my life savings due to a supposed security hole in a piece of software, the tone would be somewhat more… panic stricken
Hopefully you’ll get this sorted
Best regards, Jakob
It would be nice if McNeel gave you some king of Check or Mark as an official developer of the plugin as well, making it harder for people to try to empersonate you on this forums.
