Secure

when

Security

SafePal

<p>The rise of digital tools has made online activities easier and more convenient, but it has also created new risks for users, particularly in the financial and cryptocurrency sectors. Security researchers at Kaspersky have identified a malware strain called Stealka that primarily targets Windows users. The software is specifically designed to attack cryptocurrency wallets and browser extensions, often masquerading as gaming modifications and cheat files to deceive users into installing it.</p>
<div class="in-brief">
 <div class="in-brief--container">
  <span></span> <span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>Kaspersky describes Stealka as a Windows malware that targets crypto wallets and browser extensions while posing as game mods or cheat files.</li>
   <li>Popular crypto wallets like MetaMask, Coinbase, Binance, and Trust Wallet are at risk from this malware.</li>
   <li>Kaspersky recommends antivirus protection, two-factor authentication, cautious downloads, and backup codes to lower Stealka risk.</li>
  </ul>
 </div>
</div>
<h2 id="h-stealka-s-operation-and-distribution-tactics">Stealka’s Operation and Distribution Tactics</h2>
<p>According to Kaspersky, Stealka only becomes active when the file is opened manually by the user, after which the malware begins executing its functions. It quietly gathers sensitive information from the device and forwards it to the perpetrators’ systems, allowing attackers to access user accounts, cryptocurrency funds, and run <a href="https://www.cointribune.com/en/crypto-en/mining-en/" target="_blank" rel="noopener noreferrer nofollow">crypto mining</a> programs without the user’s knowledge.</p>
<div class="my-4">
 <div class="ads ">
 </div>
</div>
<p>The malware is commonly distributed through popular platforms, including GitHub, SourceForge, Softpedia, and sites.google.com. In more sophisticated attacks, cybercriminals create entirely fabricated websites that appear legitimate, sometimes <a href="https://www.kaspersky.co.uk/blog/windows-stealer-stealka/29939/" target="_blank" rel="noopener noreferrer nofollow">using artificial intelligence tools</a> to enhance their appearance. Without strong antivirus protection, ordinary users are unlikely to detect the deception. Even when downloads look suspicious, many users may still be misled into running the malware.</p>
<h2 id="h-stealka-s-targets-and-data-theft-capabilities">Stealka’s Targets and Data Theft Capabilities</h2>
<p>Stealka is equipped with a variety of tools, but its primary focus is harvesting information from browsers built on Chromium and Gecko engines. This exposes over a hundred browsers to potential compromise, including widely used ones like Chrome, Firefox, Opera, Yandex Browser, Edge, and Brave. The malware exploits stored data such as login credentials, addresses, and payment card information, allowing attackers to gain full access to accounts and systems.</p>
<div class="affiliate-button">
 <a href="https://store.safepal.com/safepal-s1-hardware-wallet.html?ref=cointribunecoinmediasa" target="_blank" rel="noopener noreferrer nofollow">Secure your cryptos with SafePal</a> <a href="https://www.cointribune.com/en/sponsored-content/" target="_blank" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<p>In addition, Stealka can interact with the configurations and stored data of 115 browser extensions, including those for cryptocurrency wallets, password management, and two-factor authentication. Wallets at risk include Crypto.com, SafePal, Trust Wallet, Binance, Coinbase, MetaMask, Ton, and Exodus, among others.</p>
<h2 id="h-precautionary-measures-for-users">Precautionary Measures for Users</h2>
<p>To defend against threats like Stealka, Kaspersky recommends several measures, including the following:</p>
<ul>
 <li>Installing and maintaining reputable antivirus software, while noting that even files from trusted websites can be risky because cybercriminals may exploit well-known platforms.</li>
 <li>Exercising caution with downloads such as game hacks, mods, or unlicensed software, and avoiding storing sensitive information directly in browsers to reduce potential exposure.</li>
 <li>Enabling two-factor authentication, which adds an extra layer of protection and makes unauthorized access more difficult.</li>
 <li>Keeping backup codes for important accounts, allowing recovery if credentials are compromised, and reinforcing overall account security.</li>
</ul>
<p>Stealka is part of a broader pattern of cyber threats that continue to grow in scale and sophistication. Cloudflare recently reported that <a href="https://www.cointribune.com/en/bitcoin-security-watch-out-for-phishing-scams/" target="_blank" rel="noopener noreferrer nofollow">phishing emails</a> are a major part of email-based threats, with more than half of dangerous messages containing phishing links. In total, over 5% of emails sent worldwide carry harmful content, and about a quarter of these include malicious HTML attachments. This shows the extensive reach of cyber threats beyond individual malware campaigns and reflects the importance of proactive digital security measures.</p>

Stealka Malware Poses as Game Mods to Target Crypto Wallets, Warns Kaspersky

Table of Contents

Cointribune EN

Other articles published on Dec 23, 2025

Join our free newsletter for daily crypto updates!