A remote access trojan (RAT) campaign resulted in the theft of over $235,000 in cryptocurrency. The attack affected hundreds of victims within a 48-hour period, as reported on September 20, 2026.
The malware utilized credential harvesting to capture passwords and session manipulation to bypass authentication by piggybacking on active browser sessions. The scale of the incident suggests an automated distribution strategy.
Authorities have not identified a specific malware variant, threat actor, or distribution vector. No law enforcement agency has publicly confirmed an investigation, and no recovery efforts or victim notifications have been initiated.
The incident highlights risks associated with crypto self-custody, where malware on a device can compromise private keys. Even hardware wallet users remain vulnerable if they approve malicious transactions on a compromised machine.
