Microsoft Warns of New Malware Stealing Funds from Crypto Wallets

BE[IN]CRYPTO03-18
  • Microsoft has discovered StilachiRAT, a new remote access trojan specifically targeting cryptocurrency wallets and credentials.
  • The malware focuses on stealing data from 20 cryptocurrency wallet extensions on Google Chrome, including Metamask and Trust Wallet.
  • To avoid infection, Microsoft advises using multi-factor authentication, enabling real-time protection, and downloading software from trusted sources.

Microsoft’s incident response team has discovered a new remote access trojan (RAT) called StilachiRAT that poses a serious threat to cryptocurrency users.

StilachiRAT can collect system information, steal login credentials, and extract data from digital wallets. Although it has not yet spread widely, its potential impact worries the crypto community.

How Does StilachiRAT Threaten Crypto Investors?

StilachiRAT is more than just another malware—it represents an evolution in cyber threats targeting digital assets.

Microsoft reported on March 17 that once StilachiRAT infiltrates a system, it begins reconnaissance. It gathers details about the operating system, hardware identifiers, camera presence, and active Remote Desktop Protocol (RDP) sessions. Then, it focuses on stealing credentials stored in Chrome and data from the clipboard, where users often copy passwords or wallet keys.

This trojan specifically targets 20 cryptocurrency wallet extensions on Google Chrome. Some well-known wallets at risk include Metamask, Trust Wallet, Coinbase Wallet, TronLink, TokenPocket, BNB Chain Wallet, OKX Wallet, Sui Wallet, and Phantom.

“StilachiRAT targets a list of specific cryptocurrency wallet extensions for the Google Chrome browser. It accesses the settings in the following registry key and validates if any of the extensions are installed,” Microsoft warned.

Microsoft’s report highlights StilachiRAT’s advanced anti-forensic capabilities. It can delete event logs and assess system conditions to avoid detection.

To mitigate the threat, Microsoft advises users to download software only from official sources and avoid suspicious websites or attachments. Enabling real-time protection in Microsoft Defender and using browsers with SmartScreen can help block malicious sites.

Additionally, Microsoft recommends enabling multi-factor authentication (MFA) and regularly updating software to minimize risks.

“In some cases, remote access trojans (RATs) can masquerade as legitimate software or software updates. Always download software from the official website of the software developer or from reputable sources,” Microsoft advises.

According to Chainalysis’ 2025 Crypto Crime Trends report, illicit cryptocurrency transactions range from $40 billion to $50 billion annually. These funds are stolen through various methods, including ransomware and malware attacks.

Total Cryptocurrency Value Received by Illicit Addresses (2020 – 2024). Source: Chainalysis

Chainalysis estimates that the volume of illicit crypto transactions in 2024 could exceed $51 billion, with an average annual increase of 25% between reporting periods.

Top crypto platforms in the US
Uphold Explore
Plus500 Explore
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
eToro Explore
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
Explore
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
Explore
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
Explore
Coinbase Explore
Moonacy Explore
Top crypto platforms in the US
Uphold
Plus500
eToro
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
eToro
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
eToro
Don’t invest unless you’re prepared to lose all 
the money you invest.
This is a high-risk investment and you should not expect to be protected if something goes wrong.
Take 2 mins to learn more
eToro
Coinbase
Moonacy
Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.
Click to View

Comments

We need your insight to fill this gap
Leave a comment