Video game mods are spreading new ‘Stealka’ crypto infostealer: Kaspersky

cointelegraphPubblicato 2025-12-22Pubblicato ultima volta 2025-12-22

Introduzione

A new malware called "Stealka" is targeting cryptocurrency wallets and browser extensions by disguising itself as video game cheats, mods, and software cracks, according to Kaspersky. The infostealer, discovered in November, is distributed through legitimate platforms like GitHub and Google Sites, and sometimes via fake professional-looking websites. It primarily targets Chromium and Gecko-based browsers—including Chrome, Firefox, and Edge—and steals autofill data, login credentials, and payment details. It also specifically targets 115 browser extensions related to crypto wallets, 2FA services, and password managers, including Binance, MetaMask, Trust Wallet, and Coinbase. Kaspersky advises using reliable antivirus software, avoiding pirated software and unofficial mods, and refraining from storing passwords in browsers.

New malware has been discovered that targets crypto wallets and browser extensions while disguising itself as game cheats and mods, says cybersecurity firm Kaspersky.

Kaspersky reported on Thursday that it had uncovered a new infostealer dubbed “Stealka,” which targets Microsoft Windows user data.

Attackers have used the malware, which was discovered in November, to hijack accounts, steal cryptocurrency, and install crypto miners on their victims’ computers while masquerading as video game cracks, cheats, and mods.

The malicious software has been distributed through legitimate platforms like GitHub, SourceForge, and Google Sites, and disguised as game mods, especially for Roblox, and software cracks for applications such as Microsoft Visio.

Sometimes, attackers go a step further, possibly using artificial intelligence tools, and creating entire fake websites that look “quite professional,” said Kaspersky researcher Artem Ushkov.

*A fake website pretending to offer Roblox scripts, Source: Kaspersky*

Crypto wallets and extensions targeted

Ushkov noted that Stealka has a fairly “extensive arsenal of capabilities,” but is particularly dangerous because its prime target is data from browsers built on the Chromium and Gecko engines.

This puts over 100 different browsers at risk, including popular ones such as Chrome, Firefox, Opera, Yandex, Edge, Brave, and many others.

Related: Hackers are exploiting a JavaScript library to plant crypto drainers

Its primary targets are autofill data, such as sign-in credentials, addresses, and payment card details, but it also targets the settings and databases of 115 browser extensions for crypto wallets, password managers, and 2FA (two-factor authentication) services.

Some of the 80 crypto wallets targeted include Binance, Coinbase, Crypto.com, SafePal, Trust Wallet, MetaMask, Ton, Phantom, Nexus, and Exodus.

Kaspersky also said the messaging apps, including Discord, Telegram, Unigram, Pidgin, and Tox, were also at risk, as were email clients, password managers, gaming clients, and even VPN applications.

Avoid pirated software and game mods

To stay protected, Kaspersky recommended using reliable antivirus software and password managers to avoid storing passwords in browsers. It also cautioned against using pirated software and unofficial game mods.

Cloudflare reported last week that more than 5% of all emails sent worldwide contain malicious content, and more than half of those contained a phishing link, while a quarter of all HTML attachments were found to be malicious.

Magazine: Big questions: Would Bitcoin survive a 10-year power outage?

Domande pertinenti

QWhat is the name of the new infostealer malware discovered by Kaspersky and what does it target?

AThe new infostealer is called 'Stealka'. It primarily targets data from browsers built on Chromium and Gecko engines, including autofill data (sign-in credentials, addresses, payment card details), and the settings and databases of 115 browser extensions for crypto wallets, password managers, and 2FA services.

QHow is the Stealka malware being distributed to potential victims?

AThe malware is distributed by disguising itself as video game cracks, cheats, and mods. It has been spread through legitimate platforms like GitHub, SourceForge, and Google Sites. Attackers sometimes create entire fake, professional-looking websites to host the malicious software.

QWhich specific types of applications and services are at risk from the Stealka infostealer?

AOver 100 different browsers (Chrome, Firefox, Opera, etc.), 80 crypto wallets (Binance, Coinbase, MetaMask, etc.), messaging apps (Discord, Telegram, etc.), email clients, password managers, gaming clients, and VPN applications are all at risk.

QWhat recommendations does Kaspersky provide to protect against this threat?

AKaspersky recommends using reliable antivirus software, using password managers instead of storing passwords in browsers, and avoiding the use of pirated software and unofficial game mods.

QBeyond game mods, what other type of software is commonly used as a disguise for this malware?

AThe malware is also disguised as software cracks for applications such as Microsoft Visio.

Letture associate

Coldcard Vulnerability Leads to $89 Million Theft, Sparking Largest On-Chain Migration Since FTX Collapse

A security vulnerability in Coldcard hardware wallets led to the theft of 1,367.05 BTC (approx. $89 million) from 4,585 addresses, according to Galaxy Research. The flaw, caused by insufficient randomness in seed phrase generation for specific firmware versions, triggered a massive migration of funds as users moved assets to new, secure wallets. This event caused the largest on-chain movement of small Bitcoin transactions since the FTX collapse, distorting key market indicators like active addresses and exchange deposits, and significantly dampening market sentiment. The incident also highlighted challenges in cybersecurity investigations, as researchers reported that safety guardrails on mainstream U.S. AI models hindered the analysis of attack patterns, forcing them to use an open-source Chinese AI model for forensic work. This underscores a dilemma in balancing AI security restrictions with the need for rapid response in tracing stolen crypto assets.

marsbit18 min fa

Coldcard Vulnerability Leads to $89 Million Theft, Sparking Largest On-Chain Migration Since FTX Collapse

marsbit18 min fa

Annual Salary of Millions Competing for Electricians, Meta Rushes to Open Its Own Technical School

The AI boom is facing an unexpected bottleneck: a severe shortage of skilled construction workers and electricians. As tech giants like Meta, OpenAI, and Alphabet race to build massive data centers—such as OpenAI's $16 billion "Stargate" project—they are hitting a critical labor wall. The U.S. needs an estimated 130,000 more electricians, 240,000 construction workers, and 150,000 supervisors by 2030 for AI infrastructure alone, but tens of thousands of electrician jobs go unfilled each year. While AI companies offer high premiums, with electricians earning up to $280,000 annually, worker scarcity still causes massive losses—delays on a single project can cost $14.2 million per month. The complexity of building AI data centers, which require immense power (equivalent to powering hundreds of thousands of homes), sophisticated electrical systems, and advanced liquid cooling solutions, demands highly skilled technicians who are in short supply. To combat this, companies are investing heavily in training. Meta has committed $115 million to a free training school offering tuition, housing, and stipends, targeting 5,000 new workers. OpenAI is partnering with unions to secure skilled labor. These efforts are paying off, with a significant rise in Gen Z interest in trade schools over college. However, the power demands are staggering. AI data centers are driving a rapid surge in electricity consumption, projected to account for up to 12% of U.S. power use by 2028 and raising costs for consumers. Furthermore, the construction boom is project-based, leading to a potential future glut of trained workers once building peaks, which could depress wages industry-wide. The race for AI supremacy now depends as much on skilled hands as on advanced chips.

marsbit1 h fa

Annual Salary of Millions Competing for Electricians, Meta Rushes to Open Its Own Technical School

marsbit1 h fa

OpenAI No Longer Sells Its Most Expensive Model for Profit

OpenAI is shifting its business strategy away from promoting its most expensive, flagship models for every task. Recent price cuts—80% for GPT-5.6 Luna and 20% for Terra—signal a deeper change: the company now actively advises users that many tasks don't require the most powerful model. Instead, OpenAI recommends a tiered approach: use the high-end GPT-5.6 Sol for complex planning and analysis, then delegate execution to cheaper models like Luna. This mirrors moves by Anthropic, which recently launched Claude Opus 5 at half the price of its top model, Fable 5. Both companies are de-emphasizing flagship models as primary revenue drivers, using them instead for brand prestige and technological showcases. The industry is entering a "mass-market" phase, similar to automotive, where high-volume, cost-effective models handle daily operations and drive scale. OpenAI's price reductions are partly enabled by AI models themselves optimizing underlying code and infrastructure, creating a self-reinforcing cycle of efficiency gains and cost reduction. Competition is shifting from "who is smartest" to "who offers the best value." The goal is no longer selling individual models but fostering widespread API adoption and ecosystem lock-in. By making AI calls cheap and ubiquitous, companies like OpenAI aim to become the indispensable, utility-like infrastructure powering automated workflows—the "water and electricity" of software, quietly embedded everywhere.

marsbit1 h fa

OpenAI No Longer Sells Its Most Expensive Model for Profit

marsbit1 h fa

Suspected 4th Coldcard attack wave sweeps 389 Bitcoin: Galaxy’s Thorn

Coldcard hardware wallet users are facing a new wave of coordinated attacks targeting a firmware flaw, with researcher Alex Thorn flagging 218 recent transactions moving approximately 389 Bitcoin from potentially impacted addresses. The attack pattern shows a high rate of transactions targeting unique victim addresses, differing from previous waves. The vulnerability, which causes affected devices to generate weaker wallet seeds, is estimated to have impacted over 1,100 wallets, leading to around $90 million in Bitcoin stolen. Thorn advises affected users who control their keys may attempt to move funds with a higher-fee transaction before the attacker's transactions are confirmed.

cointelegraph1 h fa

Suspected 4th Coldcard attack wave sweeps 389 Bitcoin: Galaxy’s Thorn

cointelegraph1 h fa

Bitcoin Miners Are Waving the White Flag, But Their Stocks Are Soaring

Bitcoin miners are capitulating as evidenced by a sustained drop in network hash rate and a record-steep 19.9% decline in mining difficulty, signaling the shuttering of unprofitable machines. However, in a significant divergence from historical patterns, the stocks of publicly traded mining companies have soared, with one major player gaining over 430% in the past year, even as BTC's price fell roughly 46%. This surge is largely attributed to these companies pivoting toward the more lucrative AI narrative. Simultaneously, miners face a structural squeeze. Daily block reward revenue in BTC terms has hit a new all-time low following the latest halving, with current dollar-denominated daily revenue around $30 million compared to a longer-term average of ~$40 million. Fee revenue remains negligible, covering less than one block's subsidy over a 28-day average and accounting for only about ten minutes of the network's daily security budget. This capitulation cycle is unique: miner stress and crypto price weakness have decoupled due to alternative revenue streams (AI), while the long-term reliance on increasing bitcoin prices to offset shrinking subsidies continues, with fee income still far from filling the impending gap.

marsbit1 h fa

Bitcoin Miners Are Waving the White Flag, But Their Stocks Are Soaring

marsbit1 h fa

Trading

Spot