This threat involves a multi-module infostealer malware campaign using a fake cryptocurrency trading application called Tralert FX as a lure. The malware installer is signed with a valid EV certificate from AgilusTech LLC, allowing it to bypass most antivirus detections. The campaign has been active since June 2025 and includes modules for system reconnaissance, keylogging, and browser credential theft. Data exfiltration occurs through automated git commits to five GitLab repositories every 30 minutes. Hardcoded credentials in the malware infrastructure have exposed over 4,100 commits and more than 90 compromised hosts, indicating ongoing victim compromise. The campaign is financially motivated, focusing on cryptocurrency traders to facilitate account takeover. The final payload is MoonPeak, a custom variant of the XenoRAT remote access trojan. The threat actor is linked to the Kimsuky group, operating via ProtonMail-linked GitLab accounts. No official patch or remediation guidance is provided.

The campaign enables attackers to steal sensitive information including system data, keystrokes, and browser-stored credentials from victims, primarily cryptocurrency traders. This can lead to account takeover and financial loss. The use of a valid EV code signing certificate reduces detection rates, increasing the likelihood of successful infection. The exposure of backend infrastructure credentials indicates a significant operational security failure, potentially allowing further compromise and persistence. The ongoing nature of the campaign and the scale of compromised hosts suggest a sustained threat with financial motivations.

No official patch or remediation is indicated in the available data. Security teams should be aware of the malicious domains and file hashes associated with this campaign to detect and block related activity. Due to the use of a valid EV code signing certificate, reliance solely on signature-based detection may be insufficient. Monitoring for suspicious MSI installers masquerading as legitimate trading apps and restricting installation of unverified software is recommended. Review and secure GitLab repositories and credentials to prevent data exfiltration. Follow vendor advisories if they become available for updated remediation guidance.