Microsoft warns crypto users of StilachiRAT malware targeting wallets

In an announcement, Microsoft described StilachiRAT as a remote access trojan (RAT) with advanced capabilities to evade detection and steal data.

The malware poses significant risks to cryptocurrency users by actively scanning for wallet extensions in Chrome, targeting at least 20 wallets such as MetaMask, Trust Wallet, Phantom, Coinbase, BNB Chain, and Bitget Wallet.

Once it identifies wallet extensions, StilachiRAT extracts credentials and configuration details, enabling attackers to drain funds from victims’ wallets.

StilachiRAT also monitors clipboard activity, searching for cryptocurrency keys or passwords that users may have copied. This makes it a serious security threat for digital asset holders.

Additionally, it monitors Remote Desktop Protocol sessions, allowing attackers to impersonate users and spread laterally across networks.

While the malware is not yet widespread, Microsoft has emphasized the importance of proactive defense. “Malware like StilachiRAT can be installed through multiple vectors; therefore, it is critical to implement security hardening measures to prevent the initial compromise,” the company warned.

To mitigate risks, Microsoft recommended several measures:

The crypto industry has long faced sophisticated malware and cyberattacks, with hackers continually refining their techniques to exploit vulnerabilities.

Additionally, it can suspend the system, modify Windows registry values, and enumerate open windows, indicating a versatile command set for both espionage and system manipulation. The C2 server’s command structure assigns specific numbers to what commands it will initiate

Last year, on-chain investigator Taylor Monahan highlighted an elaborate social engineering scam in which malware was distributed through fake job interviews, further underscoring the evolving tactics of cybercriminals targeting the crypto space.