Hackers Are Using Fake Crypto Wallet Screens to Steal Recovery Phrases and Browser Sessions

Criminals are using convincing cryptocurrency wallet screens and browser extensions to steal recovery phrases, login data, and active browser sessions. The activity is linked to a wider CastleLoader campaign that gives attackers several ways to gain access to infected Windows devices. The operation starts with fake software installers and ClickFix-style prompts that pressure victims into running harmful PowerShell commands. Once launched, the loader can retrieve further malware without leaving obvious files behind, making early detection more difficult. Analysts at Arctic Wolf identified the newer payloads while tracking several CastleLoader campaigns, including the Urutyka, Garrigin, and Noidret clusters. The findings...

Read the full article at the source.