Microsoft warns of a new remote access Trojan targeting cryptocurrency wallets
According to ChainCatcher news reported by Cointelegraph, tech giant Microsoft has discovered a new type of Remote Access Trojan (RAT) that specifically targets 20 cryptocurrency wallet extensions in the Google Chrome browser to steal crypto assets.The Microsoft Incident Response team revealed in a blog post on March 17 that they first detected the malware named StilachiRAT last November. This software is capable of stealing credentials, digital wallet information, and clipboard data stored in the browser. Once deployed, attackers can use StilachiRAT to scan the configuration information of the 20 cryptocurrency wallet extensions to steal crypto wallet data, including wallets such as Coinbase Wallet, Trust Wallet, MetaMask, and OKX Wallet.Microsoft's analysis pointed out: "Research on the WWStartupCtrl64.dll module of StilachiRAT, which contains RAT functionality, indicates that it employs multiple methods to steal information from the target system." Among other features, the malware can extract credentials stored in the Google Chrome local state file and monitor clipboard activity to obtain sensitive information such as passwords and encryption keys. It also has detection evasion and anti-forensics capabilities, such as clearing event logs and checking if it is running in a sandbox to thwart analysis attempts.Currently, Microsoft has not been able to identify the perpetrators behind the malware but hopes to reduce the number of potential victims by publicly sharing information. Microsoft advises users to take measures to avoid becoming victims of the malware, including installing antivirus software, and cloud-based anti-phishing and anti-malware components on their devices.
