12 stories about Malware from across the crypto press, curated and summarized daily. Most recent: Sep 17, 2026.
Chainalysis reports a 420% increase in onchain malware, linked to state-sponsored hackers from North Korea and Iran. These actors used Tron, Aptos, BNB Chain, and Bitcoin transactions to spread malware.
Russian malware called Sality secretly stole cryptocurrency by replacing copied wallet addresses for 8 years. CrowdStrike and law enforcement have now isolated over 15,000 infected machines.
At least 40 fake Firefox extensions impersonating popular wallets like OKX, Rabby, and TronLink have been confirmed as malicious. They harvest recovery phrases from users who type them in, enabling attackers to drain wallets.
Microsoft discovered that hackers are using the BNB Chain to distribute malware. They trick users into running malicious code on Windows devices through fake CAPTCHAs on compromised websites. The malware is retrieved from the blockchain, making it harder to trace and block.
A new malware called SparkKitty hides in mobile apps and scans photos for crypto wallet recovery phrases. Security firm Check Point detailed how it steals cryptocurrency by targeting seed phrases stored in images.
Cybersecurity firm Kaspersky has identified a new malware framework that uses social engineering and trojanized GitHub applications to target cryptocurrency investors, highlighting the growing sophistication of cyber threats in the crypto space.
Law enforcement disrupted three major infostealer malware operations that harvest cryptocurrency wallets and passwords, freezing €41 million in crypto. The takedown targeted SocGholish, Amadey, and StealC, which infected millions of devices worldwide.
Researchers have discovered malicious downloads on the Steam Workshop for Wallpaper Engine that distribute infostealers, backdoors, and account-hijacking malware to steal cryptocurrency and personal data from gamers.
Microsoft has identified a new malware strain that spreads through USB drives and steals cryptocurrency by hijacking clipboard data. The malware intercepts transfers and replaces wallet addresses with its own, redirecting funds to the attackers.
A new malware campaign is stealing crypto wallet data, developer credentials, and browser information from developers. The attack uses fake software packages to target users of Solana, Sui, and Aptos ecosystems. Developers are being urged to verify the authenticity of their tools to protect their assets.
A new malware campaign, TrapDoor, is stealing cryptocurrency from wallets across different blockchains. Users are advised to update their security measures and monitor their accounts for suspicious activity.
A new malware campaign called 'TrapDoor' is stealing cryptocurrency by hijacking popular AI coding assistants. The attack injects hidden instructions into developer tools, potentially affecting many in the crypto space.