According to a report by Cointelegraph, tech giant Microsoft has discovered a new remote access trojan (RAT) that specifically targets 20 cryptocurrency wallet extensions in the Google Chrome browser, stealing the crypto assets within.

Microsoft's Incident Response team revealed in a blog post on March 17 that they first detected this malware, named StilachiRAT, in November last year. The software is capable of stealing credentials, digital wallet information, and clipboard data stored in the browser. Once deployed, the attackers can use StilachiRAT to scan the configuration information of 20 cryptocurrency wallet extensions, allowing them to steal wallet data, including Coinbase Wallet, Trust Wallet, MetaMask, and OKX Wallet.

Microsoft's analysis indicates that the "WWStartupCtrl64.dll" module of StilachiRAT, which contains the RAT functionality, employs various means to steal information from the target system. In addition to other features, the malware can extract credentials saved in Google Chrome's local state files and monitor clipboard activity to obtain sensitive information such as passwords and encryption keys. It also has evasion and anti-forensic capabilities, such as clearing event logs and checking if it is running in a sandbox, to prevent analysis attempts.

Microsoft is currently unable to determine the perpetrators behind this malware but hopes to reduce the number of potential victims by publicly sharing the information. The company recommends that users take measures to avoid becoming victims of malware, including installing antivirus software, cloud-based anti-phishing, and anti-malware components on their devices.