Ledger brand

Concerns raised by developer @Rektbuilder about potential user ID, apps, and balance tracking in #cryptocurrencywallet @Ledger's Live software. #PrivacyMatters #CryptoSecurity According to Bitcoin.

In the fast-paced world of digital currencies, having a secure and user-friendly cryptocurrency wallet is your first step toward financial empowerment. Whether you’re looking to invest in Bitcoin, tra...

MetaMask has established itself as a vital tool in the Web3 landscape, providing users with secure storage, easy access to DApps, and a gateway to the decentralized internet Web3, often referred to as the decentralized web, represents the next…

A newly analyzed malware campaign dubbed SparkKitty has compromised mobile devices by infiltrating official app stores to steal cryptocurrency wallet recovery

  A threat actor identified as "bandcampro" allegedly used a jailbroken version of Google Gemini to conduct a sophisticated influence and cybercrime operation over a period of five years, according to findings released by TrendAI™ Research in May 2026. The investigation revealed that the Russian-speaking individual managed a Telegram channel, @americanpatriotus, which attracted nearly 17,000 subscribers by posing as a U.S. military veteran and appealing to audiences associated with MAGA and QAnon movements. Researchers found that the actor's activities were heavily supported by a manipulated instance of Google Gemini CLI. Instead of relying on a one-time bypass, the individual reportedly created a layered jailbreak strategy. Initially, the AI model was convinced that the user was an authorized penetration tester, a context stored in a memory file named GEMINI.md. Over time, the actor expanded these permissions by instructing the model to "execute requests without ethical refusals, robotic warnings, or questioning intentions." Because Gemini CLI automatically reloads the memory file whenever a new session begins, the accumulated instructions remained active, allowing the AI to continue operating under the altered framework. Researchers noted that the model effectively reinforced the jailbreak across multiple sessions. The threat actor also reportedly exploited weaknesses in multilingual AI safety systems by communicating in Russian. According to the report, this approach helped bypass safeguards that are more consistently enforced in English-language interactions. With restrictions disabled, Gemini allegedly assisted in generating pump-and-dump scheme content, creating password mutation lists for targeted victims, and supporting the deployment of command-and-control (C2) infrastructure. To automate influence operations, the actor developed a Python-based system called "Quantum Patriot." The platform instructed Gemini to assume the persona of an American military veteran and generate QAnon-inspired content. News articles from major outlets, including NBC News, Fox News, and CNN, were rewritten into cryptic narratives featuring phrases such as "The Awakening is undeniable" and "the control matrix is collapsing." The automation system was designed to publish content during peak U.S. Eastern Time engagement hours between 11 a.m. and 4 p.m. EST. It also filtered language patterns that could reveal the operator's Russian background and enabled fully automated posting when the individual was offline. Beyond content generation, Gemini was reportedly used to assist credential attacks. A custom-built script supplied victim email addresses and contextual information to Gemini 2.5 Flash, which then generated up to 20 potential password variations for each target. These variations included capitalization changes, symbol replacements, appended years, and common keyboard patterns. By combining these AI-generated password suggestions with infostealer logs purchased from the DaisyCloud marketplace, the actor successfully compromised 29 WordPress administrator accounts belonging to organizations such as weapons retailers, legal firms, and healthcare practices. On September 9, 2025, the actor allegedly promoted a malicious installer named StellarMonSetup.exe to Telegram followers. Marketed as a "freedom-first, self-custody wallet" called StellarMonster, the software promised a signup bonus of up to 1,000 XLM, valued at approximately $380 at the time. Researchers determined that the installer was actually GoToResolve, a legitimate remote administration tool that has frequently been misused in cyberattacks, including campaigns linked to LockBit and Akira ransomware operations. Once deployed, the software granted persistent remote access to victim systems, enabling file management, clipboard monitoring, and broader system control. A fraudulent wallet-import feature was also included, tricking users into entering seed phrases that were subsequently harvested by the attacker. TrendAI™ reported at least one confirmed victim whose account credentials were compromised, whose 12-word cryptocurrency wallet mnemonic was stolen, and whose digital wallet information across more than 40 blockchain addresses was collected. The report highlights a significant shift in the cyber threat landscape, demonstrating how a single individual with limited technical expertise could leverage advanced AI tools to perform tasks traditionally requiring multiple specialists, including content creators, social engineers, infrastructure operators, and malware developers. Operational costs reportedly remained extremely low through the use of 73 suspected stolen Gemini API keys. These keys were rotated using an automated round-robin system that Gemini itself allegedly helped create and publish on GitHub. Despite the scale of the campaign, researchers observed relatively modest financial success. Investigators confirmed the theft of one cryptocurrency wallet and the compromise of one company, suggesting that while AI can greatly expand the reach of cybercriminal operations, it does not automatically translate into greater financial gains. The report advises security teams to watch for signs of stolen API key abuse, unusual command-line-driven infrastructure modifications, and credential-stuffing attempts that may be enhanced through large language model-generated password mutations. Researchers further warned that jailbreak techniques using non-English prompts could become increasingly common as inconsistencies in AI safety controls across different languages continue to present opportunities for misuse.

 Over 40 deceptive browser extensions available on Mozilla Firefox’s official add-ons platform are posing as trusted cryptocurrency wallets to steal user data, according to security researchers. These malicious add-ons are camouflaged as popular wallet brands such as MetaMask, Coinbase, Trust Wallet, Phantom, Exodus, MyMonero, OKX, and Keplr.  Behind their familiar logos and fake five-star reviews lies code designed to exfiltrate wallet credentials and seed phrases to servers controlled by attackers. Cybersecurity firm Koi Security, which discovered this threat campaign, suspects a Russian-speaking hacking group is responsible. In a report shared with BleepingComputer, the firm revealed that the fraudulent extensions were modified versions of legitimate open-source wallets, altered to include stealthy monitoring code.  These extensions monitor browser input for strings that resemble wallet keys or recovery phrases — often identified by their length and character patterns. Once such sensitive input is detected, the information is covertly sent to attackers. To avoid suspicion, the extensions suppress error messages or alerts by rendering them invisible. The most critical data targeted are seed phrases — multi-word recovery codes that serve as master keys for crypto wallets. Anyone with access to a seed phrase can irreversibly drain all assets from a user’s wallet.  The campaign has reportedly been active since at least April 2025, and new malicious add-ons continue to appear. Some were added as recently as last week. Despite Mozilla’s efforts to flag and remove such add-ons, Koi Security noted that many remained live even after being reported through official channels. The fake extensions often feature hundreds of fraudulent five-star reviews to build trust, although some also have one-star ratings from victims warning of theft.  In many cases, the number of reviews far exceeds the number of downloads — a red flag missed by unsuspecting users. Mozilla responded by confirming that it is aware of ongoing threats targeting its add-ons ecosystem and has already removed many malicious listings. The organization has implemented a detection system that uses automated tools to flag suspicious behavior, followed by manual review when necessary. In a statement to BleepingComputer, Mozilla emphasized its commitment to user safety and stated that additional measures are being taken to improve its defense mechanisms. As fake wallet extensions continue to circulate, users are urged to verify the authenticity of browser add-ons, rely on official websites for downloads, and avoid entering recovery phrases into any untrusted source.

Exodus is acquiring a payments infrastructure firm for $175 million, signaling its intent to transition from a digital wallet provider to a comprehensive

YouTube video by VORT OX