Skip to main content

New Malware Is Draining Crypto Wallets Through Google Chrome

 


New malware is attacking cryptocurrency users, stealing wallet credentials and financial data by bypassing Chrome’s encryption and monitoring clipboard activity to intercept and redirect transactions.

A newly discovered remote access trojan (RAT) known as StilachiRAT is specifically targeting cryptocurrency users by stealing digital wallet credentials and exfiltrating sensitive data. Microsoft Incident Response researchers detailed the malware’s capabilities in a report published on March 17, 2025, highlighting its focus on compromising Google Chrome users who store cryptocurrency wallet extensions and saved login credentials.

According to Microsoft:

StilachiRAT targets a list of specific cryptocurrency wallet extensions for the Google Chrome browser.

The malware scans for 20 different wallet extensions, including Bitget Wallet (formerly Bitkeep), Trust Wallet, Tronlink, Metamask (ethereum), Tokenpocket, BNB Chain Wallet, OKX Wallet, Sui Wallet, Braavos – Starknet Wallet, Coinbase Wallet, Leap Cosmos Wallet, Manta Wallet, Keplr, Phantom, Compass Wallet for Sei, Math Wallet, Fractal Wallet, Station Wallet, Confluxportal, and Plug, allowing attackers to extract digital asset information.

Beyond targeting cryptocurrency wallets, StilachiRAT also steals stored login credentials from Google Chrome by bypassing its encryption mechanisms. The report explains: “StilachiRAT extracts Google Chrome’s encryption_key from the local state file in a user’s directory. However, since the key is encrypted when Chrome is first installed, it uses Windows APIs that rely on current user’s context to decrypt the master key. This allows access to the stored credentials in the password vault.”

This enables attackers to retrieve usernames and passwords associated with financial accounts, further increasing the risk to victims’ digital assets. Additionally, StilachiRAT establishes a command-and-control (C2) connection, allowing remote operators to execute commands, manipulate system processes, and remain persistent even after initial detection.

The malware also continuously monitors clipboard data to extract cryptocurrency keys and sensitive financial information. Microsoft’s report notes:

Clipboard monitoring is continuous, with targeted searches for sensitive information such as passwords, cryptocurrency keys, and potentially personal identifiers.

By scanning for specific patterns linked to cryptocurrency addresses, StilachiRAT can intercept and replace copied wallet addresses, redirecting transactions to an attacker-controlled destination. To mitigate the risk, Microsoft advises users to implement security measures such as enabling Microsoft Defender protections, using secure browsers, and avoiding unverified downloads. As the threat landscape evolves, cybersecurity experts urge crypto holders to stay vigilant against emerging malware designed to exploit digital assets.

Labels

Labels:

Comments

Post a Comment

Contact us

Name

Email *

Message *

Popular posts from this blog

Cryptocurrencies Adding to the Safety and Security in the UK Gambling Industry

These are exciting times for the UK gambling industry. The impact of internet technology is now being felt with online gambling now controlling the industry.  The adoption of cutting-edge technology is reasonable for the boom in the industry. From live casinos, mobile apps to artificial intelligence, incredible trends continue shaping the gambling industry. However, it is the rise of cryptocurrency casinos that seeks to redefine UK gambling.  Many operators now include crypto coins such as bitcoin, Ethereum and Litecoin as part of their banking methods. Others offer exclusive bitcoin payments and promotions based on digital tokens. This revolutionary trend has a huge impact due to enhanced safety and security on these platforms. Players looking for peace of mind when playing online now opt to use cryptocurrencies. This post looks at how cryptos guarantee the safety and security of players at online casinos. How Cryptocurrency Gambling Works There’s a lot of talk ab...
Post a Comment
Read more

Coinbase to Require Recipient Information for Crypto Transfers From Users in Canada, Singapore and Japan

  Customers in those countries who send crypto outside their Coinbase accounts must provide recipients’ names, addresses and in some cases, additional information, as of early April. Cryptocurrency exchange Coinbase Global (COIN) will soon require its customers in Canada, Japan and Singapore who send cryptocurrency to another financial institution or exchange to provide the name, address and in the case of Japan, the destination wallet of the recipient. Coinbase has been sending notices to its customers in those countries that the changes will take effect in early April in order to comply with local travel rules in those places. Coinbase didn't immediately respond to requests for additional comment on the moves, but confirmed that they were taking place. The move  does not seem to be going over well  with Coinbase customers in those countries, who value the anonymity of transactions using cryptocurrency. According to a  FAQ provided by Coinbase , for Canadian users, ...
Post a Comment
Read more

Quomodocunquize

                                       Definition:  " To make money in any way possible . ” Example:  Rather than quomodocunquizing,  invest your money wisely . Please, please, please use a hardware cold wallet like Ledger . It's  a  cold wallet ,  cold  =  not exposed  to  internet  =  only your hardware device . ...  Use Ledger  as  cold storage . Too many people spend money they earned..to buy things they don't want..to impress people that they don't like. --Will Rogers A wise person should have money in their head, but not in their heart. --Jonathan Swift Wealth consists not in having great possessions, but in having few wants. --Epictetus Money often costs too much. --Ralph Waldo Emerson Everyday is a bank account, and time is our currency. No one is rich, no one is poor, we've got 24 hours each. --Christopher...
Post a Comment
Read more