Do Son A new DarkCloud infostealer variant uses VB6 obfuscation and anti-analysis techniques to steal credentials and crypto wallets from MetaMask, Exodus, and more.
crypto wallets
Google Play now requires custodial crypto wallet providers in 15+ jurisdictions to obtain licenses. Non-custodial wallets are exempt from the new rules.
A coordinated campaign by GreedyBear used 150+ malicious Firefox extensions and fake sites to steal over $1M in crypto. They are now using a new technique called Extension Hollowing to evade detection.
Katz Stealer is a dangerous MaaS info-stealer (starting at $100/month) that plunders digital identities, evades detection with stealthy techniques, and targets a vast array of sensitive data.
Splunk exposes a campaign weaponizing Inno Setup installers to deploy RedLine Stealer, using obfuscated Pascal scripts and HijackLoader to steal browser/crypto data.
A new macOS information stealer, a potential AMOS variant, targets crypto users and Ledger Live accounts, stealing passwords and wallet data using stealthy daemonization and local admin prompt tactics.
Katz Stealer, a new stealthy MaaS, is actively stealing data from browsers, crypto wallets, and apps, using advanced evasion tactics like steganography and Discord hijacking.
A fake npm package named pdf-to-office has been discovered injecting malicious code into Atomic and Exodus crypto wallets, redirecting funds and stealing data