Microsoft

Microsoft Raises Alarm of Malware Targeting Coinbase, MetaMask Wallets

Tech Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Microsoft Raises Alarm of Malware Targeting Coinbase, MetaMask Wallets A new report from Microsoft researchers warned of malware that could steal and decrypt users’ information from 20 of some of the most popular cryptocurrency wallets. By Margaux Nijkerk| Edited by Stephen

Tech

Share this article

X iconX (Twitter)LinkedInFacebookEmail

Microsoft Raises Alarm of Malware Targeting Coinbase, MetaMask Wallets

A new report from Microsoft researchers warned of malware that could steal and decrypt users’ information from 20 of some of the most popular cryptocurrency wallets.

Microsoft shareholders voted against adding bitcoin to its company's treasury. (Photo by Craig T Fruchtman/Getty Images)

What to know:

  • Tech giant Microsoft shared a new report warning of malware that targets 20 of the most popular cryptocurrency wallets used with the Google Chrome extension.
  • The malware, dubbed StilachiRAT, could deploy “sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data.”
  • While the malware has not been distributed widely, Microsoft did share that it has not been able to identify what entity is behind the threat.

Tech giant Microsoft shared a new report warning of malware that targets 20 of the most popular cryptocurrency wallets used with the Google Chrome extension.

STORY CONTINUES BELOW
Don’t miss another story.Subscribe to the The Protocol Newsletter today. See all newsletters

Microsoft’s Incident Response researchers raised alarms of a new remote access trojan (RAT), dubbed StilachiRAT, which could deploy “sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data,” the team shared in a blog post.

According to the team, the malware was discovered in November 2024, and it could steal users’ wallet information, and any credentials, including usernames and passwords, stored in their Google Chrome browser. StilachiRAT targets 20 crypto wallets including some of the most widely-used ones like MetaMask, Coinbase Wallet, Phantom, OKX Wallet, and BNB Chain Wallet.

While the malware has not been distributed widely, Microsoft did share that it has not been able to identify what entity is behind the threat and laid out some mitigation guidelines for current targets including installing antivirus software.

“Due to its stealth capabilities and the rapid changes within the malware ecosystem, we are sharing these findings as part of our ongoing efforts to monitor, analyze, and report on the evolving threat landscape,” the team wrote.

Read more: Microsoft Shareholders Vote Down Bitcoin Treasury Proposal

MicrosoftWalletsMetaMaskPhantomcoinbase-walletCoinbase
Margaux Nijkerk

Margaux Nijkerk reports on the Ethereum protocol and L2s. A graduate of Johns Hopkins and Emory universities, she has a masters in International Affairs & Economics. She holds BTC and ETH above CoinDesk’s disclosure threshold of $1,000.

X

!–>!–>!–>
Read More

Be the first to write a comment.

Leave a Reply

Your email address will not be published. Required fields are marked *

Microsoft

Windows XP’s most famous pirated key wasn’t a hack. It was a leak

About a year ago, in a social media post, long-time Microsoft veteran Dave Plummer (who worked on Windows Task Manager) recounted the story of what’s now known as the most iconic Windows product key. We’re talking about FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8. This product key for Windows XP—which is now celebrating its 25th anniversary—made the rounds in the early

About a year ago, in a social media post, long-time Microsoft veteran Dave Plummer (who worked on Windows Task Manager) recounted the story of what’s now known as the most iconic Windows product key.

We’re talking about FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8. This product key for Windows XP—which is now celebrating its 25th anniversary—made the rounds in the early 2000s…
Read More

Continue Reading
Microsoft

GTA 6 Leaker Releases More Gameplay Videos Despite Rockstar Owner Take-Two’s Microsoft and Discord Subpoenas

UPDATE AUGUST 24, 2026: The GTA 6 leaker has continued to release new gameplay clips, and is even running a poll to decide which video to leak next despite Rockstar parent company Take-Two’s ongoing hunt for people responsible. A tenth leaked GTA 6 video was released last night, this time showing plane at night gameplay.

UPDATE AUGUST 24, 2026: The GTA 6 leaker has continued to release new gameplay clips, and is even running a poll to decide which video to leak next despite Rockstar parent company Take-Two’s ongoing hunt for people responsible.

A tenth leaked GTA 6 video was released last night, this time showing plane at night gameplay. There is no cutscene footage this time.

The watermarks are the same as those on the previous video, advertising the ‘CyberLeek’ token at the heart of the cryptocurrency scheme that is believed to be the motivating factor behind all this. Another watermark doubles down on the anti-all-digital future manifesto that formed part of the initial CyberLeek website. It reads: “They want to take your right to resell. The peaceful route got us nowhere. This was plotted by them for years. It is time to fight now or never.”

Meanwhile, CyberLeek has a new poll available on its website with a number of gameplay video choices people can vote on by sending tokens. People are currently spending hundreds of dollars’ worth of the token to vote.

This poll ends today, August 24, which suggests the leaker or leakers intend to continue to release gameplay videos even in the face of Take-Two’s subpoenas of Microsoft, Discord, and X / Twitter as part of the company’s hunt for identifying information.

We are now into the sixth consecutive day of CyberLeek releases in what has been one of the most remarkable video game leaks of all time. It is now just a few days until Rockstar’s official GTA 6 reveal, exclusive to Netflix for six hours.

UPDATE AUGUST 23, 2026: The GTA 6 leaks have stretched into a sixth consecutive day, as the person or group responsible shows no sign of slowing down even in the face of court action from Rockstar parent company Take-Two.

The latest leak is the ninth GTA 6 gameplay video to emerge this week from the ‘CyberLeek’ persona. It shows one of the two protagonists, Jason, driving to a gas station to cause havoc. There he steals a pickup truck from a conspiracy theorist. The video ends with another brief look at the same cutscene shown in the gameplay videos that were leaked yesterday.

And, as with all the leaked GTA 6 videos, this “gas” clip advertises the ‘CyberLeek’ token at the heart of the cryptocurrency scheme that is believed to be the motivating factor behind all this. A new watermark doubles down on the anti-all-digital future manifesto that formed part of the initial CyberLeek website. It reads: “They want to take your right to resell. The peaceful route got us nowhere. This was plotted by them for years. It is time to fight now or never.”

In other related news. Take-Two lawyers have issued a subpoena to X / Twitter to identify the person or persons behind three accounts that contain ‘CyberLeak’ within them. This subpoena follows two filed earlier this week requesting information from Microsoft and Discord.

ORIGINAL STORY AUGUST 22, 2026: The alleged GTA 6 leaker has released two further gameplay videos despite Rockstar owner Take-Two’s subpoenas requesting identifying information from Microsoft and Discord.

The ‘CyberLeek’ person or group released two new videos today, August 22, one showing more supercar gameplay and an armed robbery, the other strip club gameplay. The latter appears to taunt Take-Two and Rockstar by showing a snippet of a cutscene in which a character says they need to take “a leak.” This is the second cutscene to emerge this week, and there is growing concern that the leaker has access to a build of the game and may post significant story spoilers.

These new videos are the seventh and eighth to leak this week. And, like all the others, they advertise the ‘CyberLeek’ memecoin as part of what is widely considered to be a crypto scheme.

Every Detail in the GTA 6 Cover Art Explained

On August 20, Take-Two issued Digital Millennium Copyright Act (DMCA) subpoenas in a federal court requesting information from both Microsoft and Discord as part of its hunt for the leaker or leakers behind the recent spate of GTA 6 gameplay videos. Take-Two wants identifying information associated with user accounts that were members of a number of Discord servers, including one relating to Australian GTA content cr

Read More

Continue Reading
Microsoft

Microsoft and Valve sued, PlayStation’s first party downturn, and could a UK social media ban impact games? – Patch Notes #55

Plus: Atari acquires Hipster Whale and Mina the Hollower hits 300,000 sales…

Plus: Atari acquires Hipster Whale and Mina the Hollower hits 300,000 sales…
Read More

Continue Reading
Microsoft

Nvidia and Microsoft drop cryptic coordinates pointing to an ARM powered PC revolution at GTC Taipei 2026

This morning I woke to social media teasers from both Nvidia and Microsoft, which seen many on social media speculating about it’s meaning. The identical posts feature a simple message – a new era of PC is coming. This isn’t jsut a new generation of an existing architecture…

This morning I woke to social media teasers from both Nvidia and Microsoft, which seen many on social media speculating about it’s meaning. The identical posts feature a simple message – a new era of PC is coming. This isn’t jsut a new generation of an existing architecture…
Read More

Continue Reading