A phishing campaign targeted streamers to get them to download it.

In March 2026, we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets.

In August 2026, forty npm typosquatting packages were used as couriers to deliver a Windows payload from a GitHub account named bebraz1, with a WSL-aware install script bridging from a developer’s Linux shell to the Windows host underneath. The delivered Rust-based wrapper unpacked an encrypted in-memory stealer that targeted cryptocurrency wallets, Chromium browser credentials, and Telegram sessions, then attempted to exfiltrate data through upload.gofile.io after fingerprinting the victim via api.ipify.org. #bebraz1 #main.exe #gofile.io #api.ipify.org #WSL

The alleged thieves infected 8,000 devices.

The alleged thieves infected 8,000 devices.

Introduction A sophisticated, Turkish-speaking threat actor has been running an active infostealer and cryptocurrency clipper campaign since at least June 23, 2026, with the latest payload update occurring on July 6. What sets this operation apart from typical commodity malware is its entire toolkit sitting in an open directory on a DigitalOcean node (46.101.111.120:8080) with anonymous read-write access, version-stamped backups showing rapid iteration from early builds to v5 in under two weeks.

It seems that antivirus developers will need to ramp up their efforts. Researchers have discovered new malware that went undetected by top antivirus programs...

Socket identified TrapDoor, an active cross-ecosystem crypto stealer campaign spanning npm, PyPI, and Crates.io that uses malicious developer tools to steal wallets, SSH keys, cloud credentials, browser data, and environment variables. The operation is tied to the GitHub account ddjidd564, uses the marker P-2024-001, and abuses AI-facing files like .cursorrules and CLAUDE.md for persistence and hidden prompt injection. #TrapDoor #ddjidd564 #P-2024-001 #eth-security-auditor #trap-core.js

A phishing campaign targeted streamers to get them to download it.

Steam has taken down a game containing malware that drained the cryptocurrency wallets belonging to hundreds of players, as reported earlier by Bleeping Computer. The free-to-play 2D platformer, titled BlockBlasters, took more than $150,000 from victims, including $32,000 from a streamer raising funds for their cancer treatment. In a post on X, malware tracker vx-underground revealed that bad actors targeted some streamers with a spearphishing campaign that attempted to lure victims into promoting the game in exchange for compensation. “Unfortunately, the Steam game was actually a cryptodrainer masquerading as a legitimate video game,” vx-underground wrote in a post on X.

Beveiligingsonderzoekers van Kaspersky hebben een nieuwe malwarecampagne aangetroffen, waarbij aanvallers via apps proberen cryptovaluta te stelen. Het is volgens de onderzoekers voor het eerst dat ee...