steal

Theo thông tin từ ChainCatcher, theo báo cáo của Cointelegraph, công ty an ninh mạng Morphisec đã tiết lộ rằng một ứng dụng giả mạo mang tên "Claude Opus 5 Free Desktop" thuộc Anthropic đang được sử dụng để phát tán phần mềm độc hại RevStealer trên Windows. Phần mềm này có khả năng đánh cắp dữ liệu ví tiền điện tử từ hơn 50 loại, đồng thời còn thu thập thông tin nhạy cảm như mật khẩu trình duyệt, Cookie, cấu hình VPN, lịch sử tin nhắn và ảnh chụp màn hình.RevStealer có cơ chế chống phát hiện, sẽ thực hiện kiểm tra môi trường trên thiết bị mục tiêu trước khi thực thi, nếu phát hiện đặc điểm của môi trường gỡ lỗi hoặc ảo hóa thì sẽ dừng hoạt động. Ngoài ra, công ty an ninh mạng Nga Kaspersky cũng đã tiết lộ một khung phần mềm độc hại mới mang tên OkoBot nhắm vào các nhà đầu tư tiền điện tử, có khả năng thu thập tệp ví, tiêm các tiện ích độc hại và chụp lại cửa sổ ứng dụng ví để đánh cắp tài sản.

Recently, the People's Procuratorate of Licang District, Qingdao City, Shandong Province, China, handled a Bitcoin theft case. The defendant, Zhang, obtained the mnemonic phrase while assisting an acquaintance in registering a virtual currency wallet, and later transferred 107 BTC in multiple transactions, equivalent to over 50 million yuan at current market prices. Zhang argued that his actions were a "protective takeover," but the prosecution found that he transferred the stolen BTC through multiple trading platforms and exchanged it for over 660,000 yuan. The Licang District Court sentenced Zhang to 10 years and 9 months in prison for theft and imposed a fine of 100,000 yuan; the second instance upheld the original judgment.Reports indicate that the prosecutor handling the case strictly adhered to laws and judicial policies, and after in-depth analysis, concluded that although China's regulatory policies deny the legal currency status of virtual currencies, they do not negate their property attributes, nor do they prohibit citizens from legally holding and circulating them. Bitcoin requires investment in computing power, funds, and other costs to acquire, which gives it economic value; rights holders can achieve exclusive control and management through private keys and mnemonic phrases, aligning with the core characteristics of "property" in criminal law, making it a target for theft. In determining the amount, since virtual currencies have no official pricing, the Licang District Procuratorate discarded market price estimates and used the actual proceeds from the crime of over 660,000 yuan as the amount for theft, ensuring accurate conviction, appropriate sentencing, and unity of guilt and punishment.

A man in Florida, USA, was arrested for allegedly stealing approximately $1.9 million worth of Bitcoin by using the mnemonic phrase of his former employer's hardware wallet. Police stated that the unauthorized transfer of the stolen funds occurred in 2020, when the suspect still had access to critical security information.

On-chain analyst "b-block" posted on social media on Monday that a counterfeit Uniswap website is stealing funds from multiple wallets, with assets held by the scammers valued at over $400,000. Stacy Muur, founder of the Web3 marketing agency Green Dots, shared screenshots of false sponsored results from search engines, criticizing Google for ignoring this issue for years, leading to fake links ranking above real ones, resulting in users continuously being scammed.According to Etherscan data, the two flagged addresses hold a total of about 146 ETH, valued at approximately $306,000. DeFiLlama pointed out that fake ads on Google are a common source of phishing attacks. The crypto nonprofit organization Security Alliance (SEAL) reported in April that phishing activities on Google searches significantly increased in March, with attackers deploying highly deceptive fake ads by paying for or hijacking legitimate ad accounts, using seemingly real URLs to bypass Google's automatic checks, and loading malicious payloads through hidden iframes.SEAL has blocked over 356 malicious ad links and stated that the volume of Google ads deployed by attackers has remained stable for over a year, with no slowdown in attack activities. Reports indicate that between March 13 and 30 alone, a total of $1.27 million was stolen. Additionally, earlier this month, there were malicious ad campaigns targeting Mac users that utilized Google ads and the AI chatbot Claude for shared chats. Malwarebytes also reported that Facebook is similarly a hotspot for fake ads and scams.

According to Blockaid monitoring, the cross-chain routing protocol Squid is currently under continuous attack on the SquidRouterModule on the Ethereum and Base networks. Within about two hours of the attack, 86 Gnosis Safe wallets have been emptied, with losses amounting to approximately 3 million dollars.The attacker subsequently exchanged all stolen tokens for DAI through their controlled Uniswap V3 liquidity pool and consolidated them into a single address. Currently, this consolidated wallet holds approximately 3.07 million dollars in DAI.

The Fuzhou City Cangshan District People's Procuratorate disclosed that a man was sentenced to 12 years and 7 months in prison for theft after stealing 4 Bitcoins from others and illegally profiting about 900,000 yuan, with a fine of 300,000 yuan. The second instance upheld the original verdict.The case shows that at the end of 2020, Wang entrusted Lin to assist in cashing out the Bitcoins he held. During the process of accessing Wang's Bitcoin wallet hard drive and computer, Lin stole the wallet's "private key" and related data, transferring 4 Bitcoins into his own name, and subsequently sold them for profit. In 2024, after Wang discovered abnormal asset activity, he reported it to the police, and Lin was subsequently arrested.The procuratorial authority stated that although current regulations clearly indicate that virtual currencies do not have the status of legal tender, Bitcoins possess value, manageability, and transferability, meeting the general characteristics of "property" in criminal law, and are subject to property crime. Relevant infringement actions will also be held criminally accountable.

According to Livecoins, the property crime investigation department DEIC of São Paulo, Brazil, in collaboration with the electricity company CPFL Piratininga, conducted an operation that seized approximately 1,400 Bitcoin mining machines suspected of operating with stolen electricity. It is estimated that the amount of stolen electricity is enough to supply about 2,000 households for a month. Although Bitcoin mining is not illegal in Brazil, the focus of the actions by CPFL and DEIC is on the theft of electricity.

The Chief Information Security Officer of Slow Fog, 23pds, disclosed on platform X that node-ipc has been compromised again. The released three malicious versions of node-ipc (9.1.6, 9.2.3, 12.1) carry the same credential-stealing payload, with the package being downloaded over 10 million times per week.

According to the blockchain security organization SlowMist (@SlowMist_Team), a highly complex npm worm named "Mini Shai-Hulud" is spreading through well-known developer projects such as TanStack, UiPath, and DraftLab, as monitored by their threat monitoring system MistEye. Attackers hijack GitHub credentials to publish malicious packages disguised as legitimate updates, embedding a hidden script router_init.js that runs silently in CI/CD environments like GitHub Actions, specifically designed to steal CI/CD keys, cloud infrastructure keys, and cryptocurrency wallet information, using GitHub's own infrastructure for data exfiltration.SlowMist has synchronized relevant threat intelligence (IOC) with clients and recommends that projects using the affected packages immediately check their CI/CD pipelines for the presence of the router_init.js file, rotate all exposed GitHub, cloud service, and cryptocurrency credentials, and continuously monitor for abnormal background activities in the development environment.

According to market news, Microsoft's security research team has discovered that attackers have been inducing users to run malicious terminal commands by publishing fake macOS troubleshooting guides since the end of 2025, thereby stealing cryptocurrency wallets, iCloud data, and passwords saved in browsers.These fake guides are published on platforms such as Medium, Craft, and Squarespace, targeting common user issues like freeing up disk space or fixing system errors, and tricking users into copying and pasting malicious commands into the terminal, which automatically downloads and runs malware. This social engineering technique, named ClickFix, bypasses macOS's Gatekeeper security mechanism because the victims are actively executing the commands.The malware families involved include AMOS, Macsync, and SHub Stealer, which can steal cryptocurrency wallet keys from Exodus, Ledger, and Trezor, as well as usernames and passwords saved in Chrome and Firefox. In some cases, attackers also delete legitimate wallet applications and replace them with trojan versions. Apple has added a protective feature in macOS version 26.4 to prevent the pasting of potentially malicious commands.

Former Singapore Navy personnel Zhang Rongxuan (35 years old, phonetic) was sentenced to six years and ten months in prison after stealing 1.7 million Tether (nearly 2.3 million Singapore dollars) from a friend's cold wallet, which he spent on luxury watches, gambling, and paying off a mortgage.It is reported that Zhang Rongxuan was a member of the Naval Diving Unit at the time of the incident, holding the rank of captain. After getting to know the victim, he also co-managed a non-fungible token trading platform with friends, which is affiliated with Upstairs Research Pte Ltd and owned by DiGi Selection Holdings Pte Ltd. After security companies tracked the cryptocurrency wallet, Zhang Rongxuan admitted that he committed the crime due to suffering significant losses from the collapse of the FTX exchange.

According to The Block, North Korea has denied allegations of its involvement in cryptocurrency theft, calling the claims "absurd defamation" and a "political tool." The statement was released by state media, emphasizing that necessary measures will be taken to safeguard national interests.However, data from blockchain analysis firm TRM Labs shows that hacker groups associated with North Korea have stolen approximately $577 million, accounting for about 76% of global cryptocurrency theft losses during the same period. This includes two major attack incidents on KelpDAO (approximately $292 million) and Drift Protocol (approximately $285 million).TRM pointed out that the related attacks are mainly associated with the Lazarus Group and its sub-organizations. Since 2017, the cumulative scale of cryptocurrency theft linked to North Korea has exceeded $6 billion. U.S. and international agencies generally believe that such funds are used to support military and missile programs. Meanwhile, the U.S. Treasury has recently imposed sanctions on related individuals and entities, involving approximately $800 million in illegal fund flows for 2024.

On-chain detective ZachXBT replied that PolyArb is a fraudulent prediction market product, and its website contains a wallet stealer.Previously, PolyArb claimed on platform X that the Hyperliquid HIP-4 results market reached a daily BTC trading volume of $6.15 million within 48 hours, which was questioned by user growth head William LeGate regarding its claims about Polymarket fees. ZachXBT warned that replying to the relevant account might bring more exposure to them and lead to an increase in potential victims.

According to a research report by cybersecurity company Expel, it is tracking a highly assessed APT organization supported by North Korea (DPRK) called "HexagonalRodent," which primarily targets Web3 developers and specializes in stealing high-value digital assets such as cryptocurrencies and NFTs.The organization mainly conducts attacks by forging job postings—posting high-paying positions on LinkedIn and Web3 recruitment platforms to lure job seekers into completing "skills tests" embedded with malicious code, using the tasks.json feature of VSCode to automatically execute malicious programs when victims open project folders. The malware used includes BeaverTail, OtterCookie, and InvisibleFerret, which have capabilities for password theft, remote control, and reverse shell.It is noteworthy that the organization heavily utilizes generative AI tools such as ChatGPT and Cursor to develop malware, build fake company websites, and create AI-generated executive teams, even registering shell companies in Mexico to enhance the credibility of their attacks

According to monitoring by the blockchain security firm SlowMist, MistEye has received threat intelligence from the community indicating that a malware named "MacSync Stealer" (v1.1.2) is active and highly destructive. This malware targets macOS users, stealing sensitive data including cryptocurrency wallets, browser credentials, system keychains, and infrastructure keys (SSH/AWS/K8s).The malware uses a spoofed AppleScript system dialog for phishing and displays fake error messages stating "unsupported" after data leakage. It has immediately synchronized this IOC (Indicator of Compromise) to clients. Do not execute unverified macOS scripts and remain highly vigilant against unexpected system password prompts. If an attack is suspected, immediate remediation is required: change all infrastructure credentials (SSH/AWS/K8s), invalidate any exposed keychains, and quickly migrate cryptocurrency assets to a secure wallet.

The crypto wallet Zerion disclosed that North Korean hackers are using AI for long-term social engineering attacks, stealing approximately $100,000 from the company's hot wallet.Zerion confirmed that user funds, applications, and infrastructure were not affected, and has proactively disabled the web application as a precaution. Zerion also stated that the attackers obtained some session and credential information from team members who were logged in, as well as the private keys of the company's hot wallet, and pointed out that AI is changing the way cyber threats operate.

According to GoPlus Security, a piece of malware named Infiniti Stealer is targeting Mac users' cryptocurrency wallets and sensitive credentials through a "ClickFix" social engineering attack method.The attackers forge a highly realistic Cloudflare CAPTCHA page to lure users into opening the terminal and manually pasting malicious commands. After executing the command, the script removes the macOS quarantine attribute and silently writes subsequent payloads to the /tmp directory. The final payload is a native macOS binary compiled with Nuitka, significantly increasing the difficulty of detection by security tools. Once deployed, Infiniti Stealer can steal Chromium / Firefox browser credentials, macOS Keychain, cryptocurrency wallets, and developer key files (such as .env files), and it has sandbox detection and delayed execution capabilities to evade tracking.

According to Slow Fog monitoring, the Apifox desktop client has encountered a supply chain attack, with front-end script files hosted on its official CDN being injected with highly obfuscated malicious JavaScript code.Affected users may face risks such as credential theft, sensitive data leakage, and remote command execution, with the malicious code executing automatically and being highly concealed. Slow Fog recommends that users immediately revoke all Tokens, reset passwords, log out and log back in to invalidate sessions, block the *.apifox.it.com domain, clear local storage, and review API logs and abnormal activities.

According to market news, the domain name of the Bitcoin wallet Samourai Wallet, which was once famous for its privacy features, has now been taken over by scammers after being seized by the FBI, and is being used to host phishing sites to steal Bitcoin.Domain records show that the website was registered through a privacy protection service, and the current owner's identity is unknown. Multiple users on the X platform have reported the phishing site to the domain registrar NameCheap, requesting the site be shut down, but have not yet received a response.

According to Cryptopolitan, a new type of malware called GhostClaw is targeting cryptocurrency wallets on macOS devices.This malware disguised itself as a legitimate OpenClaw CLI tool and was present in the npm registry for a week before being removed after infecting 178 developers. Once developers run the "npm install" command, a hidden script globally installs the GhostClaw package and evades detection through obfuscated configuration files. GhostClaw scans the clipboard every three seconds, capturing private keys, seed phrases, public keys, and other cryptocurrency wallet and transaction-related data.After the second stage payload is downloaded, GhostLoader scans for cryptocurrency wallet data in the Chromium browser, macOS Keychain, and system storage, clones browser sessions to gain access to logged-in wallets, and steals API Tokens that connect to AI platforms such as OpenAI and Anthropic. The stolen data is sent to the attackers via Telegram, GoFile, and command servers.