New “Eternl Desktop” Phishing Lure Drops LogMeIn to Hijack Cardano Wallets

A new phishing campaign dubbed by security researchers as a wolf in sheep’s clothing targets Cardano users with a professionally branded “Eternl Desktop” lure. The campaign begins with a convincing email titled “Eternl Desktop Is Live – Secure Execution for Atrium & Diffusion Participants,” which promises greater security and control but delivers a silent payload designed to grant attackers persistent, remote access.

The attackers use a trusted tool, dropping LogMeIn Resolve inside a wallet installer, a technique described as bypassing many security filters through the use of a legitimate remote management and monitoring product. According to Anurag’s findings, the installation of this RMM tool is likely the first phase of a broader attack, enabling potential credential harvesting or manipulation of transactions once persistent access is established.

The analysis flags the installer as a high-risk indicator due to a newly registered download domain and the silent drop of a management tool, and Cardano users are urged to verify updates through official channels and treat unsolicited announcements with extreme caution.