LeakyInjector and LeakyStealer Duo Hunts For Crypto and Browser History

A new two-stage malware named LeakyInjector and LeakyStealer has been identified, targeting cryptocurrency wallets and browser history. LeakyInjector uses low-level APIs for injection to avoid detection and injects LeakyStealer into explorer.exe. LeakyStealer implements a polymorphic engine to modify its memory area at runtime. Both stages were signed with valid Extended Validation certificates. The malware performs reconnaissance on infected machines, targeting multiple crypto wallets, including browser extensions, and searches for browser history files from various browsers. It establishes persistence through registry manipulation and beacons to the C2 server at regular intervals. The malware exfiltrates sensitive data and can execute additional commands received from the C2 server.

• New PamStealer variant targets macOS via fake crypto walletMalware2026-09-22
• ‘The Gentlemen’ Profile: Why This Ransomware Group Wants In Before It Locks You OutMalware2026-08-27
• The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operationMalware2026-10-21
• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsCampaign2026-10-08
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07