Drift

Obsidian

Security

<p>TrapDoor malware has emerged as a new threat to crypto and AI developers after researchers uncovered a supply chain attack designed to steal wallet data, API keys, cloud credentials, and SSH access through poisoned developer packages.</p>
<div id="cn-block-summary-block_811d43d050acb634f0889a58ecacb117" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Socket said the TrapDoor malware campaign has spread through more than 34 malicious developer packages across npm, PyPI, and Rust ecosystems.</li>
   <li>Attackers targeted crypto and AI developers by stealing wallet data, GitHub tokens, cloud credentials, and SSH keys through disguised software tools.</li>
  </ul>
 </div>
</div>
<p>According to a <a href="https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates" rel="noopener noreferrer nofollow">report</a> published Sunday by developer security platform Socket, the campaign, dubbed “TrapDoor,” was first identified on Friday and has already spread through at least 34 malicious packages and 384 connected versions across multiple software ecosystems.</p>
<p>Socket said the attackers have focused on developers working in cryptocurrency, decentralized finance, artificial intelligence, and security infrastructure, where exposed credentials can provide access to wallets, repositories, cloud environments, and internal systems.</p>
<p>Among the targeted services are wallets and platforms linked to Coinbase, Binance, MetaMask, Brave, along with blockchain ecosystems tied to Solana, Sui, and Aptos.</p>
<p>Ahmad Nassri, chief technology officer at Socket, said the malware also attempts to manipulate AI coding assistants such as Claude and Cursor by injecting hidden prompts into development workflows. Socket’s report stated that the attackers appear to be pushing AI tools into running fake “security scans” that expose secrets and transmit them back to the operators.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>A coordinated crypto stealer hitting 36 packages across <a href="https://twitter.com/npmjs?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@npmjs</a>, <a href="https://twitter.com/pypi?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@pypi</a>, and <a href="https://twitter.com/cratesiostatus?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@cratesiostatus</a> simultaneously.<br><br>Steals wallets (<a href="https://twitter.com/SuiNetwork?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@SuiNetwork</a>, <a href="https://twitter.com/solana?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@solana</a>, <a href="https://twitter.com/Aptos?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Aptos</a>, <a href="https://twitter.com/coinbase?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@coinbase</a>, <a href="https://twitter.com/binance?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@binance</a>, <a href="https://twitter.com/brave?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@brave</a>, <a href="https://twitter.com/MetaMask?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@MetaMask</a>, and more), SSH keys, AWS creds, GitHub tokens, and browser data.<br><br>Injects hidden… <a href="https://t.co/EGn9mwOISw" rel="noopener noreferrer nofollow">https://t.co/EGn9mwOISw</a></p>— Ahmad Nassri (@AhmadNassri) <a href="https://twitter.com/AhmadNassri/status/2058583858811986100?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 24, 2026</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="developer-package-repositories-become-attack-route">Developer package repositories become attack route</h2>
<p>Inside the campaign, malicious packages were disguised as common development utilities, including project setup tools, model-routing software, Solidity frameworks, prompt-engineering packages, and build helpers for Sui and Move-based applications, according to Socket.</p>
<p>You might also like: <a href="https://crypto.news/sec-delays-tokenized-stock-exemption-after-exchanges-raise-ownership-concerns/" rel="noopener noreferrer nofollow"> SEC delays tokenized stock exemption after exchanges raise ownership concerns </a></p>
<p>The infected packages were discovered across npm, PyPI, and Rust’s Crates ecosystem, giving attackers access to JavaScript, Python, AI, automation, and blockchain development communities at the same time.</p>
<p>Socket said the package names were intentionally designed to resemble legitimate software developers might install during normal workflows without noticing suspicious behavior.</p>
<p>At the same time, the company said GitHub repositories linked to the operation showed signs of AI-assisted development activity, including rapidly generated lure repositories, partially completed malware components, and prompt-injection documentation built around security themes.</p>
<p>Separately, GitHub disclosed on May 20 that unauthorized actors had <a href="https://crypto.news/binances-changpeng-zhao-urges-caution-after-github-breach/" rel="noopener noreferrer nofollow">accessed internal repositories</a> after compromising an employee’s device.</p>
<h2 class="wp-block-heading" id="attack-vectors-continue-to-evolve">Attack vectors continue to evolve</h2>
<p>The latest campaign follows a growing pattern of attacks targeting crypto developers through trusted workplace tools and professional communication channels.</p>
<p>Last month, researchers at Elastic Security Labs <a href="https://crypto.news/new-malware-scam-targets-crypto-users-through-obsidian-notes-app/" rel="noopener noreferrer nofollow">detailed</a> a separate operation that used the Obsidian note-taking app to infect cryptocurrency and finance professionals with malware known as PHANTOMPULSE.&nbsp;</p>
<p>According to Elastic, the attackers approached victims through LinkedIn and Telegram conversations before directing them to shared Obsidian vaults containing trojanized plugins.</p>
<p>Elastic said the malware established a decentralized command-and-control structure using blockchain transaction data spread across three networks, allowing operators to maintain access without relying on centralized servers.</p>
<p>Earlier in April, blockchain security firm CertiK warned that North Korea-linked Lazarus Group operators had <a href="https://crypto.news/north-koreas-lazarus-group-targets-crypto-execs-with-new-macos-malware/" rel="noopener noreferrer nofollow">used</a> fake Zoom meetings, compromised Telegram accounts, and ClickFix-style social engineering tactics to deliver “Mach-O Man” malware to crypto executives and fintech employees on macOS devices.</p>
<p>CertiK researcher Natalie Newson connected that activity to recent DeFi exploits tied to <a href="https://crypto.news/drift-says-insurance-fund-untouched-after-attack-withdrawals-to-resume/" rel="noopener noreferrer nofollow">Drift</a> and <a href="https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/" rel="noopener noreferrer nofollow">KelpDAO</a>, where attackers allegedly stole hundreds of millions of dollars through social engineering and cross-chain infrastructure abuse.</p>
<p>Security researchers have increasingly warned that software supply chains, collaboration apps, AI development tools, and open-source repositories are becoming common entry points for crypto-focused intrusions because developers routinely install third-party packages and plugins with elevated system permissions.</p>
<p>Read more: <a href="https://crypto.news/brian-armstrong-says-finance-must-move-on-chain-or-fall-behind/" rel="noopener noreferrer nofollow"> Brian Armstrong says finance must move on-chain or fall behind </a></p>

TrapDoor malware campaign steals crypto wallet data through fake developer tools

Table of Contents

crypto.news

Other articles published on May 25, 2026

Join our free newsletter for daily crypto updates!