Hackers Are Using Fake Crypto Wallet Screens to Steal Recovery Phrases and Browser Sessions

Criminals are using convincing cryptocurrency wallet screens and browser extensions to steal recovery phrases, login data, and active browser sessions.

The activity is linked to a wider CastleLoader campaign that gives attackers several ways to gain access to infected Windows devices.

The operation starts with fake software installers and ClickFix-style prompts that pressure victims into running harmful PowerShell commands.

Once launched, the loader can retrieve further malware without leaving obvious files behind, making early detection more difficult.

Analysts at Arctic Wolf identified the newer payloads while tracking several CastleLoader campaigns, including the Urutyka, Garrigin, and Noidret clusters.

The findings show attackers expanding from general credential theft into tools built specifically for cryptocurrency users and browser session theft.

Arctic Wolf said in a report shared with Cyber Security News (CSN) that this development raises the stakes for people who manage digital assets from their computers.

A stolen recovery phrase can give an attacker permanent control of a wallet, while a hijacked browser session may let them bypass a password reset or an existing login check.

Hackers Are Using Fake Crypto Wallet

The most notable addition is a Rust-based NeedleStealer wallet spoofer that displays a polished imitation of a desktop wallet application.

It supports brands including Ledger, Trezor, and Exodus, with the most complete fake interfaces designed to request a victim’s recovery seed phrase.

This shows how the malware presents a believable recovery prompt. Rather than exploiting a weakness in the wallet software itself, the attackers rely on a user entering the secret phrase into a screen that looks trustworthy.

In the Noidret campaign, the wallet spoofer is delivered through a Node.js-based injector and a small shellcode component.

The malware is unpacked in the ProgramData directory alongside a legitimate Node.js binary, helping the operation blend in with normal-looking software activity.

The shift toward wallet theft complements earlier CastleLoader activity, which has been tied to broad information stealing and remote access tools.

Readers following the CastleLoader attacks on government can see how the loader has continued to evolve into a flexible delivery platform.

The new toolkit may reflect more focused cryptocurrency targeting. Recovery phrases are especially valuable because a victim cannot simply change them after disclosure in the way they would reset a password.

The campaign also relies on familiar social engineering. Users may encounter fake update pages, misleading installers, or prompts asking them to paste a command into Windows, a tactic also seen in fake Windows update screens used to deliver information stealers.

Browser Extensions Extend Access

A second NeedleStealer component, written in Golang, installs malicious browser extensions that masquerade as legitimate software.

In the observed campaign, the extension posed as an ad blocker while quietly establishing persistent access to browser data and sessions.

This approach is dangerous because an active session token can be more useful than a password.

If attackers steal the token from a signed-in browser, they may be able to access an account without knowing the password or triggering a fresh login challenge.

The malicious extension installer also places extensions that appear legitimate, which may reduce suspicion during a quick review.

The tactic resembles other campaigns involving malicious wallet browser extensions, where deceptive add-ons seek credentials and wallet information.

Defenders should block the listed infrastructure at DNS, firewall, and endpoint layers, while treating unusual PowerShell, IronPython, Node.js, and Python activity from ProgramData or AppData as a warning sign.

Arctic Wolf also recommends application allowlisting and preventing unsigned or unexpectedly signed binaries from running in user-writable locations.

Organizations should enable PowerShell Script Block Logging and Module Logging, monitor for Mark-of-the-Web removal, and investigate Node.js execution outside approved development environments.

Staff should also be taught that a legitimate update, CAPTCHA, or verification page will not ask them to open Run and paste a command.

For security teams, reviewing browser extension permissions and watching for unauthorized changes can limit exposure to session theft.

Similar controls are relevant in fake MetaMask wallet campaigns, where attackers modified browser-based wallet environments to capture sensitive data.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.