Microsoft warns of new remote access trojan targeting crypto wallets

Cointelegraph

Tech giant Microsoft has discovered a new remote access trojan (RAT) that targets crypto held in 20 cryptocurrency wallet extensions for the Google Chrome browser.

Microsoft’s Incident Response Team said in a March 17 blog post that it first discovered the malware StilachiRAT last November and found it can steal information such as credentials stored in the browser, digital wallet information and data stored in the clipboard.

After deployment, the bad actors can use StilachiRAT to siphon crypto wallet data by scanning for the configuration information for 20 crypto wallet extensions, including Coinbase Wallet, Trust Wallet, MetaMask and OKX Wallet.

“Analysis of the StilachiRAT’s WWStartupCtrl64.dll module that contains the RAT capabilities revealed the use of various methods to steal information from the target system,” Microsoft said.

Among its other capabilities, the malware can extract credentials saved in the Google Chrome local state file and monitor clipboard activity for sensitive information like passwords and crypto keys.

It can also use detection evasion and anti-forensics features, like the ability to clear event logs and check for signs it’s running in a sandbox to block analysis attempts, according to Microsoft.

At the moment, the tech giant says it can’t pinpoint who is behind the malware but hopes that publicly sharing information will lower the number of people who might be snared.

“Based on Microsoft’s current visibility, the malware does not exhibit widespread distribution at this time,” Microsoft said.

“However, due to its stealth capabilities and the rapid changes within the malware ecosystem, we are sharing these findings as part of our ongoing efforts to monitor, analyze, and report on the evolving threat landscape.”

Microsoft suggests to avoid falling prey to malware; users should have antivirus software, cloud-based anti-phishing and anti-malware components on their devices.

Losses to crypto scams, exploits and hacks totaled nearly $1.53 billion in February, with the $1.4 billion Bybit hack accounting for the lion’s share of losses, according to blockchain security firm CertiK.

Blockchain analytics firm Chainalysis said in its 2025 Crypto Crime Report that crypto crime has entered a professionalized era dominated by AI-driven scams, stablecoin laundering, and efficient cyber syndicates, with the past year witnessing $51 billion in illicit transaction volume.

Risk Warnings and Disclaimers

You understand and acknowledge that there is a high degree of risk involved in trading. Following any strategies or investment methods may lead to potential losses. The content on the site is provided by our contributors and analysts for information purposes only. You are solely responsible for determining whether any trading assets, securities, strategy, or any other product is suitable for investing based on your own investment objectives and financial situation.

Risk Disclosure

The risk of loss in trading financial instruments such as stocks, FX, commodities, futures, bonds, ETFs and crypto can be substantial. You may sustain a total loss of the funds that you deposit with your broker. Therefore, you should carefully consider whether such trading is suitable for you in light of your circumstances and financial resources.

No decision to invest should be made without thoroughly conducting due diligence by yourself or consulting with your financial advisors. Our web content might not suit you since we don't know your financial conditions and investment needs. Our financial information might have latency or contain inaccuracy, so you should be fully responsible for any of your trading and investment decisions. The company will not be responsible for your capital loss.

Without getting permission from the website, you are not allowed to copy the website's graphics, texts, or trademarks. Intellectual property rights in the content or data incorporated into this website belong to its providers and exchange merchants.

Recent Searches

Top Searches

Markets

Analysis

User

24/7

Economic Calendar

Education

Data

Microsoft warns of new remote access trojan targeting crypto wallets

Risk Disclosure