Crypto malware (infostealers)

Infostealers are the workhorse of crypto theft. Once installed, they sweep a machine for wallet extension data, desktop wallet files, saved passwords, cookies that keep exchange sessions logged in, screenshots and any text file that looks like a seed phrase, then send everything to the attacker within seconds. They are sold as subscriptions on criminal forums, so even unskilled scammers can run campaigns.

Delivery is mostly social: fake job interviews that ask candidates to run a coding test, game beta invitations, cracked software, fake trading tools, browser updates on compromised sites and messages from hijacked accounts in Telegram or Discord groups. North Korean groups have used fake recruiter schemes to plant malware on developers' machines. Mobile variants appear as fake wallet apps or trojans that read screens.

Encrypted wallet files are not safe once a stealer has your password too, and session cookies can bypass two-factor authentication. Hardware wallets limit the damage because keys never touch the computer, but users can still be tricked into signing malicious transactions. Keep wallets on clean devices, avoid running untrusted files and treat any unsolicited download as hostile.