Home > Top > Body

Microsoft Flags Trojan Malware Targeting MetaMask, Phantom and Coinbase Wallets

clock
2025-03-18 11:13:23

Microsoft security researchers have identified a new malware threat targeting popular crypto wallet extensions including MetaMask and Phantom.

The StilachiRAT remote access trojan was first discovered in November 2024 and has since been deeply analyzed to reveal the depth of this threat. Specifically, it can target crypto wallets.

MetaMask, Coinbase, Phantom, Keplr and more could be at risk as the RAT is able to scan for cryptocurrency wallet extensions in the Google Chrome browser. It can then extract and decrypt saved credentials to access usernames and passwords.

The information gathering RAT can continuously monitor clipboard content, as it actively hunts for sensitive information like cryptocurrency keys and passwords.

The researchers shared examples of the regular expressions the RAT uses to scan clipboard contents for credentials, noting that they're seeking information related to the Tron network—which is particularly popular in China.

Microsoft says that StilachiRAT targets specific wallets including: Bitget Wallet, Trust Wallet, TronLink, MetaMask, TokenPocket, BNB Chain Wallet, OKX Wallet, Sui Wallet, Braavos - Starknet Wallet, Coinbase Wallet, Leap Cosmos Wallet, Manta Wallet, Kepler, Phantom, Compass Wallet for Sei, Math Wallet, Fractal Wallet, Station Wallet, ConfluxPortal, and Plug.

Aaron Walton, Threat Intel Analyst at Expel, told Decrypt: "Infostealing malware, leverages social engineering to trick users into downloading and executing malicious code. These lures range from everything from a download, to a job offer, or even a fake-captcha that interrupts a user while web browsing.

"There is big money to be made and the tactics criminals are using can bypass basic security and even business level defenses."

StilachiRAT appears to be using anti-forensic behaviors, including clearing event logs and evading detection.

The Microsoft Incident Response team says: "Based on Microsoft’s current visibility, the malware does not exhibit widespread distribution at this time. However, due to its stealth capabilities and the rapid changes within the malware ecosystem, we are sharing these findings as part of our ongoing efforts to monitor, analyze, and report on the evolving threat landscape."

Edited by Stacy Elliott.

Web3 Desktop Trading Tool
Stay ahead of the game in the cryptocurrency space.

7x24 Newsflash

01:24 2025-07-07
Elon Musk: The "American Party" Will Embrace Bitcoin
Asked by an X user whether the party would embrace bitcoin, Mr. Musk replied: "Fiat money is hopeless, so yes."
01:18 2025-07-07
Ripple Announces Mercado Bitcoin to Tokenize $200 million RWA on XRP Ledger
Ripple released a statement on Friday saying that Brazilian cryptocurrency exchange Mercado Bitcoin plans to complete the tokenization of $200 million of real-world assets (RWA) on XRP Ledger, including fixed income and equity assets. Silvio Pegado, managing director of Ripple Latin America, said the move shows that public blockchain infrastructure is gaining institutional trust and becoming a reliable technical foundation for regulated financial products.
01:07 2025-07-07
Spot gold lost $3,320
On July 7th, spot gold fell by $8 in 15 minutes, falling to $3,320 per ounce, a decline of 0.53% in the day.
01:07 2025-07-07
This is the first major attack on ships in the region in months. The shipping crisis in the Red Sea may escalate again, and the global trade artery has sounded the alarm again. Click to view...
This is the first major attack on ships in the region in months. The shipping crisis in the Red Sea may escalate again, and the global trade artery has sounded the alarm again. Click to view...
01:03 2025-07-07
Hong Kong Treasury Secretary: Target to issue stablecoin licenses within this year
The Hong Kong Stablecoin Ordinance came into effect in August, and the Hong Kong Treasury Secretary Hui Zhengyu said that the HKMA is currently consulting the market on the implementation of the regulation guidelines. The guidelines will be announced this month, and the specific content will involve anti-money laundering and other related requirements. He also stated that the number of stablecoin licenses granted will be in single digits. He hopes to receive applications after the ordinance come...
01:01 2025-07-07
Daily Hong Kong Stock Market News Express (Monday, July 7)
Important news: 1. UBS: Since June, demand has continued to weaken, and it is reasonable for photovoltaic glass manufacturers to cut production by 10% to 20%. Stock news: 1. New China Insurance (01336.HK) plans to invest 11.25 billion yuan to subscribe for three phases of Private Offering Fund shares. 2. Zhengrong Real Estate (06158.HK) The cumulative contract sales amount in the first 6 months is about 2.365 billion yuan. 3. Country Garden (02007.HK) The contract sales amount attributable to th...
01:00 2025-07-07
Gold maintains range volatility, and bulls continue to wait for this signal! If silver can break through here, it is expected to test the previous high... Click to view the key points of each asset based on order flow...
Gold maintains range volatility, and bulls continue to wait for this signal! If silver can break through here, it is expected to test the previous high... Click to view the key points of each asset based on order flow...
01:00 2025-07-07
Early trading opened, the main domestic futures contracts fell more and less, synthetic rubber fell more than 2%, No. 20 rubber, SC crude oil, container shipping line fell nearly 2%. In terms of gains, cotton rose 0.44%.
Early trading opened, the main domestic futures contracts fell more and less, synthetic rubber fell more than 2%, No. 20 rubber, SC crude oil, container shipping line fell nearly 2%. In terms of gains, cotton rose 0.44%.
00:57 2025-07-07
Hong Kong Treasury Secretary: Target to issue stablecoin licenses within this year
On July 7, China's Hong Kong Stablecoin Ordinance came into effect in August. Xu Zhengyu, director of the Hong Kong Treasury, said that the HKMA is currently consulting the market on the implementation of the regulations guidelines. The guidelines will be announced this month. The specific content will involve anti-money laundering and other related requirements. He also stated that the number of stablecoin licenses granted will be in the single digits. He hopes to receive applications after the...
00:56 2025-07-07
According to the latest brokerage pending order data, gold pays attention to multiple supports near 3320, silver is wary of an empty order ambush, and there is strong resistance in Europe, America and other places... Click to view the latest report
According to the latest brokerage pending order data, gold pays attention to multiple supports near 3320, silver is wary of an empty order ambush, and there is strong resistance in Europe, America and other places... Click to view the latest report
00:38 2025-07-07
This week, CHEEL, APT, IMX and other tokens will be unlocked in large quantities, with a total value of more than 200 million US dollars
Token Unlocks data shows that this week CHEEL, APT, IMX and other tokens will usher in a large amount of tokens to unlock, with a total value of more than 200 million US dollars. The currencies with unlocked tokens worth more than 1 million US dollars are as follows: CHEEL will unlock 20.81 million tokens worth about $109.48 million on July 13. APT will unlock 11.31 million tokens on July 12, worth about $50.78 million, accounting for 1.75% of the circulation. IMX will unlock 24.52 million token...
00:32 2025-07-07
There is a "big chess" behind the Pentagon's suspension of military aid to Ukraine? US officials exposed a shocking insider: the aid did not actually endanger the US military's own weapons supply, but the defense minister insisted on going his own way. Click to view...
There is a "big chess" behind the Pentagon's suspension of military aid to Ukraine? US officials exposed a shocking insider: the aid did not actually endanger the US military's own weapons supply, but the defense minister insisted on going his own way. Click to view...