Attackers Deploy LeakyInjector and LeakyStealer to Hijack Crypto Wallets and Browser Info

Cybersecurity researchers, according to Hybrid Analysis, have uncovered a two-stage malware campaign targeting cryptocurrency wallet users and browser data, with the LeakyInjector as the initial stage and LeakyStealer as the data thief.

LeakyInjector uses low-level Windows APIs to inject into explorer.exe and stores LeakyStealer in an encrypted form using ChaCha20, then decrypts and deploys it to the target system, while maintaining persistence by copying itself as MicrosoftEdgeUpdateCore.exe in AppData and creating a Run registry entry.

The campaign aims at wallet apps such as Electrum, Exodus, Atomic, Sparrow, Ledger Live, Guarda, and BitPay, and also targets browser extensions like MetaMask, Phantom, Coinbase Wallet and Trust Wallet, as well as history files from Chrome, Edge, Brave, Opera and Vivaldi. Exfiltrated data is sent to the C2 server at Everstead, using HTTP POST with browser-like user agents, and LeakyStealer employs a polymorphic engine and a bot ID created by XOR-ing the C drive volume serial number with a constant.

Both components were signed with valid Extended Validation certificates issued to Hefei Nudan Jukuang Network Technology Co., Ltd., adding another layer of legitimacy to the payload.