Stealka Malware Disguised as Game Mods to Steal Crypto

Crypto News Exploits

Stealka Malware Masquerades as Game Mods to Steal Crypto Wallets

Written by Aaron S.,

Editor-In-Chief

Last Updated: December 22, 2025

Key Takeaways

Stealka malware hides as game mods or pirated software on trusted sites and steals browser and crypto wallet data from over 100 apps;
It targets Chrome, Firefox, and over 80 crypto wallets like MetaMask, Binance, and Coinbase, accessing autofill and session data;
Kaspersky warns users to avoid pirated downloads and use secure antivirus tools and password managers to protect sensitive information.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Stealka Malware Masquerades as Game Mods to Steal Crypto Wallets

BITDEGREE IN YOUR SOCIAL FEED

A new malware known as Stealka has been identified targeting crypto wallets and browser tools by hiding itself as game mods and pirated software, according to cybersecurity firm Kaspersky.

Kaspersky explained in a report that the malware is distributed through reputable platforms like GitHub, SourceForge, and Google Sites, where it is disguised as cheats or modifications for games such as Roblox, and even pirated versions of tools like Microsoft Visio.

Stealka targets data stored in over 100 Chromium and Gecko based browsers, including Chrome, Firefox, Opera, Edge, and Brave.

What is an Automated Market Maker in Crypto? (Animated)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Key information it can access includes autofill data such as logins, addresses, and payment information, as well as browser sessions and data from 115 browser extensions tied to wallets, password managers, and two-factor authentication tools.

The malware specifically targets around 80 crypto wallets, including MetaMask, Binance $4.55B , Coinbase $879.51M , Crypto.com, SafePal, Trust Wallet, Ton, Phantom, Nexus, and Exodus.

It also puts messaging apps like Discord, Telegram, Pidgin, Tox, email tools, password management apps, gaming platforms, and even VPN programs at risk.

To reduce risk, Kaspersky advises using trusted antivirus solutions and password managers rather than storing sensitive information in browsers. Downloading pirated software or unofficial game mods is discouraged.

On November 25, security firm Socket found a Chrome add-on called “Crypto Copilot” stealing small amounts of Solana during Raydium trades. How does it work? Read the full story.