Microsoft security researchers have disclosed a new remote access trojan (RAT) named StilachiRAT, first observed in November 2024, that is specifically designed to steal credentials and cryptocurrency wallet data from compromised Windows systems. According to Microsoft’s analysis, the malware performs extensive system reconnaissance, collects browser-stored passwords, monitors clipboard contents, and then scans Chrome profile data for configuration files associated with around 20 crypto wallet extensions, including popular wallets such as MetaMask, Phantom, Trust Wallet, OKX Wallet, Sui Wallet, Coinbase Wallet, and Keplr. Once it finds these wallets, StilachiRAT attempts to extract and decrypt sensitive information that could enable threat actors to take over accounts and drain funds. Beyond data theft, StilachiRAT maintains a persistent foothold and remote control over infected hosts via a command‑and‑control (C2) server, allowing attackers to execute commands, launch programs, manage services, monitor RDP sessions, and erase logs to hinder forensic analysis. Microsoft notes that the malware has not yet been distributed at large scale but uses advanced evasion techniques, including checks for sandboxes and analysis tools, making it harder to detect with standard defenses. Security advisories from Microsoft and other vendors emphasize hardening basic practices—such as avoiding storage of critical credentials in browsers, reviewing and limiting installed wallet extensions, and keeping endpoint protection and patching regimes up to date—because successful compromise can expose both crypto assets and broader account access across a victim’s digital footprint.

AI-generated background, compiled from web sources — not editorial content.

More coverage

Explore the topic

More on malware

Kaspersky exposes active OkoBot malware targeting hundreds across 25+ countries with crypto wallet and seed phrase theft

Kaspersky exposes active OkoBot malware targeting hundreds across 25+ countries with crypto wallet and seed phrase theft

Securelist ·

SlowMist uncovers macOS malware that steals Telegram sessions and swaps Ledger, Trezor apps for phishing loaders

SlowMist uncovers macOS malware that steals Telegram sessions and swaps Ledger, Trezor apps for phishing loaders

slowmist.medium ·

Security researcher Vladimir S. details how organized crypto hacking gangs exploit email, malware, fake support, and wallet approvals to steal millions through scalable social engineering

Security researcher Vladimir S. details how organized crypto hacking gangs exploit email, malware, fake support, and wallet approvals to steal millions through scalable social engineering

𝕏/@officer_secret ·

Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch

Humanity Protocol's 447M H token attack wasn't a hack—it was operational security FAIL: malware on a dev machine gave attackers full root access to 7 private keys, draining $31M+ because devs backed up keys to the wrong device during mainnet launch

humanityprotocol.notion.site ·

DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malware

DPRK-linked Contagious Interview campaign turns Web3 job tests into wallet-stealing malware

𝕏 ·

Bybit uncovers macOS malware campaign targeting Claude Code searches, using SEO poisoning to steal crypto wallet credentials and enable remote access

Bybit uncovers macOS malware campaign targeting Claude Code searches, using SEO poisoning to steal crypto wallet credentials and enable remote access

𝕏/@CoinDesk ·

Explore the full feed

Comments

Up nextMichael Saylor unveils a 38-book curriculum for leaders, arguing that history, technology, capital, energy and Bitcoin are essential to building stronger civilizations