Armorsteal is a Python-based malware kit that steals sensitive data and mines cryptocurrency. It persists on infected Windows systems by installing in a hidden directory and creating scheduled tasks. The malware uses obfuscation and sandbox evasion techniques and includes modules for backdoor access, cryptocurrency mining, keystroke logging, clipboard manipulation, and credential theft from browsers, Discord, wallets, and password managers. It uses multiple command-and-control domains and disables Windows Defender to avoid detection.
The PC launcher for the game "Goddess of Victory: NIKKE" was compromised via a supply chain attack involving tampered script files on the official CDN between September 27 and November 4, 2026. The altered scripts installed a remote access agent named K2F capable of executing arbitrary commands and stealing credentials from browsers, cryptocurrency wallets, and cloud services. The malware persisted by injecting a DLL into Chrome to intercept wallet recovery phrases. The initial compromise stemmed from domain hijacking of insightjs.com. The vendor detected and remediated the issue by replacing files and deploying automated detection and removal on November 5. Users who ran the Windows PC launcher during the compromise window were potentially affected.
In October 2026, attackers linked to North Korea's TraderTraitor operation stole approximately $6.34 billion from Binance through a sophisticated multi-stage supply chain compromise. The attack began with a fake job interview that tricked engineers into downloading trojanized developer tools, including a weaponized Terraform provider. Malicious backdoors named FLATROOF and ROOFDECK were embedded within legitimate-looking developer software, enabling lateral movement from compromised developer workstations to Binance's wallet signing infrastructure. ReversingLabs detected these malicious components 77 days before public disclosure, highlighting the advanced nature of the threat targeting DevOps environments.
North Korean threat actors, identified as the Lazarus Group, conduct cryptocurrency thefts by initially compromising developers through social engineering on the open internet. They trick developers into running malicious projects, which leads to planting malware in cryptocurrency wallet interfaces, as seen in the February 2025 Bybit theft and a similar Binance compromise. These operations use pre-registered domains and US-registered front companies to deliver malware, including through fake job interviews. Preemptive defenses have identified numerous malicious domains mimicking Binance, enabling defenders to block infrastructure before attacks occur.
A malicious JavaScript file was found in a third-party performance monitoring integration on Polymarket. The script was designed to access authenticated trading sessions, inspect user portfolios, and transfer cryptocurrency assets to attacker-controlled addresses. It operates by reading authentication data from local storage, navigating React components to find trading functions, and creating signed messages to move assets. Polymarket has removed the compromised third-party integration. The extent of victimization and total losses are currently unknown.
In September 2026, infostealer malware was predominantly distributed via SEO poisoning, masquerading as illegal software like cracks and keygens. Distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage. Executable files made up 90.8% of samples, with 9.2% using DLL side-loading techniques involving legitimate DLLs such as python37.dll and POWRPROF.dll. A new Rust-based infostealer named Lzveil was identified, which downloads configuration from command and control servers and employs modified Base64 decryption, XOR encryption, and LZNT1 compression. Email campaigns spread DarkCloud and AgentTesla infostealers, impersonating construction and logistics firms. These malware variants steal credentials, browser data, cryptocurrency wallets, and system information, with stolen data often sold on dark web markets or used in secondary attacks.
The Psychedelic Stealer is an active malware campaign targeting Ukrainian small-business websites as of September 2026. It tricks victims with a fake Cloudflare CAPTCHA page to manually run msiexec.exe commands that install malware. This malware steals browser credentials, session tokens, and cryptocurrency wallet data from wallets such as MetaMask and Trust Wallet. It maintains persistence through browser extensions using native messaging and scheduled tasks, and communicates with a REST API for further commands. The campaign uses signed Microsoft binaries and avoids encoded PowerShell scripts to evade detection. It is financially motivated and specifically targets Ukrainian victims.
The Underground malware campaign uses an Aotera/Tedy loader to inject a Vidar-class stealer into Windows processes. It targets cryptocurrency exchange accounts by injecting malicious scripts into Chrome and Edge sessions, enabling automatic theft via fake security overlays and email manipulation. The malware also includes a clipboard hijacker that replaces copied cryptocurrency wallet addresses with attacker-controlled addresses. Active since October 2023, the operation has stolen approximately $100,000 from 350-430 victims across 23 blockchain networks. Infection begins with lure archives containing trojanized files and includes anti-analysis checks against 67 monitoring tools. The campaign rapidly rotates Cloudflare-fronted domains to evade reputation-based detection.
Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain against vulnerable iPhones. The fraudulent pages mimic Apple's design and offer a $500 voucher to lure victims, but simply opening the page in Safari triggers an exploitation attempt without requiring user interaction. The attack targets iPhones running unpatched iOS versions, attempting to bypass security protections and deploy a payload designed to steal saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. The exploit leverages vulnerabilities previously disclosed by Google in March 2026 and patched by Apple. If successful, the payload establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.
A detailed technical analysis examines the evolution of MacSync, a macOS stealer-as-a-service initially known as Mac.c, which targets cryptocurrency enthusiasts and developers. The malware has undergone significant changes, replacing AppleScript-based droppers with binary executable files written in Objective-C and Swift. The infection chain utilizes malicious DMG images and employs iCloud infrastructure for payload delivery. MacSync collects extensive data including browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The stealer incorporates novel techniques like PAM API for password verification and features a backdoor module for persistent access. Distribution occurs through social engineering, fake applications, and cracked software disguised as legitimate crypto wallets like the nonexistent Toria wallet, promoted through dedicated websites and social media channels.
The Lazarus subgroup TraderTraitor conducted targeted campaigns in 2026 against cryptocurrency-related and non-cryptocurrency entities, including a notable $292 million theft from KelpDAO via LayerZero. A smaller IT services provider in India was also compromised through social engineering involving fake job interview lures with weaponized Terraform projects. Malicious GitHub repositories with typosquatted domains delivered macOS backdoors FLATROOF and ROOFDECK during terraform init execution. These backdoors facilitated reconnaissance, credential theft, and cloud environment escalation. After public disclosure of the LayerZero attack, attackers deployed an updated ROOFDECK backdoor and removed earlier implants, continuing activity until June 2026 before abandoning the intrusion due to low value from the smaller target.
Six Chrome and Firefox extensions linked through shared code, C2 infrastructure, and publishing history have been identified targeting cryptocurrency traders. Four malicious extensions steal authenticated session tokens and wallet data from Axiom Trade and Padre users, while two earlier extensions reveal a pattern of repackaging crypto trading tools. The extensions J7Tracker, VREO, and Orbit Tracker automatically retrieve user information, wallet bundles, Firebase tokens, and application state, then exfiltrate data to threat actor-controlled Vercel deployments. The campaign targets an active trading community with Axiom processing over $15 billion in volume across 650,000 wallets. The malicious code runs inside authenticated sessions, collecting localStorage, IndexedDB data, and API responses containing authentication tokens and wallet keys. Data is Base64-encoded and transmitted via browser navigation to avoid CORS restrictions, enabling account compromise and cryptocurrency theft.
An investigation revealed a sophisticated cryptocurrency and credential-stealing operation using Amatera stealer as the primary payload. The attack chain leverages Cloudflare Workers to inject JavaScript stored on BNB Smart Chain, presenting fake Google CAPTCHA prompts that lead to WebDAV-based DLL execution. Two parallel infection chains were identified, one loading through a DLL named 'pf.ch' and another through 'verification.google', both delivering Amatera stealer with different secondary payloads. The 'pf.ch' variant deployed ZigCryptoStealer via NativeAOT loader and a Go-based reverse proxy, while the 'verification.google' variant installed NetSupport Manager with C2 infrastructure in Russia. The operation affects numerous countries with primary focus on stealing cryptocurrency wallets, credentials from password managers, and various authentication data through extensive collection rules targeting over 400 applications.
On August 31, 2026, U.S., Bulgarian, Hungarian, and Romanian authorities, collaborating with CrowdStrike and Shadowserver Foundation, successfully disrupted the Sality botnet through a peer-to-peer sinkhole operation. Active since 2003, Sality infects Windows executables and spreads malware for credential theft, spam distribution, and DDoS attacks. The botnet delivered EggJagger clipper malware, stealing at least $150,000 through cryptocurrency wallet substitution. The takedown exploited Sality's P2P architecture weakness by manipulating peer lists, isolating over 15,000 infected machines from threat actor control. This peer list manipulation technique prevented payload distribution by inserting sinkhole entries and removing legitimate peers. Associated domains were seized across U.S. and Europe. While the disruption stops new payloads, existing infections remain active requiring remediation. The operation demonstrates that resilient P2P criminal infrastructure can be dismantled through coordinated law enf...
A campaign identified by the Socket Threat Research team involves 19 malicious browser extensions (18 for Chrome, 1 for Edge) active since February 2024. These extensions deliver a modular malware framework that communicates with command and control servers via WebSocket, strips Content Security Policy headers, and uses cross-site scripting (XSS) injection to execute payloads. The primary goal is to steal cryptocurrency wallet secrets and drain crypto assets, as well as harvest credentials. The threat actor either creates malicious extensions from scratch or compromises legitimate extensions with existing user bases, such as the 'Enable Right Click & Copy' extension with tens of thousands of users. The campaign, named 'Superior,' shows sophisticated and evolving capabilities targeting multiple cryptocurrency platforms and exchanges.
A newly identified Android malware family named Manic combines banking malware and mobile spyware capabilities, targeting Ukrainian banks, government services, messaging applications, Russian and European financial institutions, and global fintech and cryptocurrency services. Active since February 2026, Manic enables extensive Device Takeover operations through sophisticated surveillance and remote-control features. It employs advanced PIN stealing techniques without requiring traditional overlay attacks, utilizing Accessibility services as a UI keylogger to capture lock-screen inputs, recovery phrases, and authentication codes. A distinctive feature is its Wi-Fi mesh egress technique, allowing compromised devices to relay stolen data through other infected phones via Wi-Fi Direct, Bluetooth, or BLE when direct C2 access is unavailable. The malware monitors 169 applications including banks, cryptocurrency wallets, government eID services, and military-focused messengers across multiple countries.
Following Black Hat and DEF CON conferences, a threat actor targeted attendees through X direct messages, posing as CoinDesk's VP and Head of Marketing to establish trust under the pretext of conference planning. The campaign employed a malicious Google Apps Script embedded in a Google Doc that presented ClickFix-style instructions and manual download options. The attack delivered different payloads based on the victim's operating system: macOS users received AMOS infostealer, while Windows users were infected with NetSupport RAT, a Ledger wallet implant, and a TLS-intercepting proxy. A secondary lure masqueraded as a DocSend installer to deliver additional payloads. The operation demonstrated sophisticated social engineering by leveraging trusted platforms and post-conference networking expectations.
A new ClickFix campaign targets Windows users with a NodeJS-based infostealer delivered via malicious MSI installers. This highly adaptable remote access Trojan minimizes forensic footprints through dynamic capability loading, with core stealing modules and communication protocols delivered in-memory only after C2 connection. The malware routes gRPC streaming traffic over Tor network for persistent, masked bidirectional channels. An operational security failure exposed server-side admin panel protocol definitions, revealing a malware-as-a-service backend designed to manage multiple operators and automate cryptocurrency asset tracking. The modular architecture delivers malicious logic dynamically as strings executed in-memory, bypassing static signature detection while supporting full RAT functionality including shell command execution and wallet tracking.
In February 2026, an active malware delivery campaign named Powercat was observed distributing infostealer malware disguised as utility or cheat software for popular PC games including Roblox, Minecraft, and Grand Theft Auto V. The multi-stage infection chain begins with an initial executable that profiles victims and establishes persistence, followed by a Java-based loader that deploys the final infostealer payload. The malware targets cryptocurrency wallets (Exodus, Atomic, Monero-Gui), browser data from Chromium-based applications, Discord tokens, and gaming accounts with payment information. It includes surveillance capabilities such as keylogging, webcam capture, and screen recording. The campaign particularly targets children who frequent gaming platforms and pay-to-cheat websites, with evidence suggesting collected personal information may be used for blackmail or coercion into illegal activities.
A sophisticated macOS malware campaign leverages ClickFix social engineering to infect victims. The attack begins with a fake CAPTCHA prompt delivered via email links, tricking users into executing malicious commands in Terminal. This downloads a profiling script that collects system information and deploys architecture-specific Go-based Mach-O payloads. The stealer targets browser passwords, Apple Keychain credentials, and cryptocurrency wallets. Its most notable feature is a DRAIN function that gradually siphons cryptocurrency from victims' wallets by redirecting portions to attacker-controlled accounts. The malware supports Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. Infrastructure analysis reveals hosting through Aeza Group, a sanctioned Russian bulletproof hosting provider. The malware achieves persistence through macOS Background Task Management and uses various evasion techniques including Gatekeeper bypass and credential harvesting via fake system prompts.
