Stealka Malware Disguised as Game Mods Threatens User Data
Cybersecurity firm Kaspersky has uncovered a new malware strain, dubbed “Stealka,” which targets crypto wallets, browser extensions, and Microsoft Windows user data. First discovered in November, Stealka has been used to hijack accounts, steal cryptocurrencies, and even install crypto miners on victims’ computers, all while disguising itself as game cheats, cracks, and mods.
Malware Distribution via Legitimate Platforms
According to Kaspersky, the malware has been spread through widely used platforms like GitHub, SourceForge, and Google Sites, often masquerading as mods for games such as Roblox, or software cracks for applications including Microsoft Visio. Kaspersky researcher Artem Ushkov noted that attackers sometimes create entire fake websites, possibly with AI tools, that appear “quite professional.”
Crypto Wallets and Browsers at Risk
Stealka’s main danger lies in its targeting of browsers built on Chromium and Gecko engines, putting over 100 browsers at risk, including Chrome, Firefox, Opera, Edge, Brave, and Yandex. The malware primarily steals autofill data such as sign-in credentials, addresses, and payment card information. Additionally, it targets 115 browser extensions, including crypto wallets, password managers, and two-factor authentication (2FA) services.
Among the 80+ crypto wallets affected are Binance, Coinbase, Crypto.com, SafePal, Trust Wallet, MetaMask, Ton, Phantom, Nexus, and Exodus. Messaging apps such as Discord, Telegram, Unigram, Pidgin, and Tox are also vulnerable, alongside email clients, gaming platforms, password managers, and even VPN software.
