The Wpcdoor backdoor malware was distributed through a South Korean company's DVR management software (CMS). The attack involves DLL side-loading to install a first-stage downloader that retrieves a second-stage downloader, which then executes the Wpcdoor backdoor in memory. Wpcdoor exfiltrates sensitive system information including screenshots, clipboard contents, browser credentials, and cryptocurrency wallet extension data. It targets wallets such as MetaMask, Coinbase, and Phantom. The attacker group Larva-26013 continues to deploy Wpcdoor via multiple vectors beyond the initial DVR software compromise.