Netcrook
#Cryptocurrency
The Browser Was the Wallet Thief: A Fake Notes Extension and the Quiet Swap Attack
A disguised browser add-on linked to a crypto clipper campaign shows how transaction tampering can happen inside the browser, not on the blockchain.
When a Notes Add-On Becomes a Payment Trap: The Silent Swap Crypto Clip
Researchers flagged a browser-extension campaign that impersonates a familiar note-taking tool and aims to swap cryptocurrency wallet addresses at transaction time.
SimpleHelp’s Control Panel Became the Target: A Tiny Flaw, a Big Malware Path
A critical weakness in remote-support software shows how one privileged login path can become a launch point for malware, secret theft, and broader endpoint risk.
Seized Crypto, New Purpose: How a Court Order Turned Digital Assets into State Financing
Ukraine’s asset recovery agency moved more than $8.3 million in cryptocurrency into an official wallet, showing how custody, legality, and blockchain controls collide once criminal proceeds become public funds.
Fallback Domains, Fake App Sites, and the Android Trapdoor Behind Rokarolla
The malware campaign tied to Rokarolla shows how mobile fraud tooling can survive pressure on one control channel by pairing impersonation sites with backup command infrastructure and permission abuse.
Operation Endgame Turns the Spotlight on the Access Economy Behind Cybercrime
A new phase of disruption against infrastructure linked to SocGholish, Amadey, and StealC shows how loaders and stealers help turn one intrusion into many crimes.
Fake Early-Access GTA 6 Pages Turn Hype Into a Crypto Payment Trap
A surge of scam websites is using the promise of “VIP” access to Grand Theft Auto 6 to pressure hopeful players into sending cryptocurrency and, in some cases, hundreds of dollars.
Fake GTA 6 Access Pages Turn Fan Hype Into a Crypto Paywall
A polished impersonation scam is using the pull of Grand Theft Auto VI to push victims toward cryptocurrency payments for access that never arrives.
CryptoBandits Turns a USB Habit Into a Crypto Theft Risk
A new Windows malware family is reported to spread through USB devices and use Tor, while altering wallet addresses to steal cryptocurrency.
Fake Popularity, Real Theft: The Clip-on Trap Hiding Behind GitHub Stars and VirusTotal Votes
A deceptive trust layer is being abused to make a crypto clipper look safer than it is, turning stars, reviews, and clipboard swaps into a quiet route to theft.
Mastra’s npm Trail Turns a Package Update Into a Crypto-Extension Risk
A malicious dependency found in more than 140 Mastra packages shows how a software supply-chain incident can move from build tools to browser-facing cryptocurrency surfaces.
USB, Tor, and a Wallet Thief: A Small Malware Build With Outsized Reach
A newly spotted lightweight backdoor combines removable-media spread with cryptocurrency theft, showing how compact malware can still punch through modern defenses.
Windows Scripting, USB Shortcuts, and Tor: The Hidden Machinery Behind a Crypto Clipper
Microsoft says a Windows-based cryptocurrency clipper has been active since February 2026, and its design leans on built-in scripting, shortcut abuse, and Tor-hosted command infrastructure.
When a Friendly Voice Becomes the Bait: How Crypto Clippers Borrow Trust Before Stealing It
A reported campaign pairs AI-style narration, fake reputation signals, and a Rust-based clipboard hijacker to quietly redirect cryptocurrency payments.
Inside the Cash-Out Layer: The AudiA6 Takedown Shows Where Crypto Crime Becomes Harder to Hide
A coordinated law-enforcement action against a suspected laundering service puts the spotlight on the infrastructure that helps illicit crypto move, layer, and reach spendable value.
AudiA6 Taken Down: The Laundering Layer Cybercriminals Depend On
A coordinated international operation has disrupted AudiA6, a cryptocurrency laundering service believed to have moved more than EUR 336 million and helped criminal networks turn stolen value into spendable money.
Mac Users Are Being Tricked Into Opening the Trapdoor
Weaponized DMG installers are turning a normal macOS software flow into a fast credential-theft path, with infostealers built to grab browser sessions and wallet data before defenders notice.
When a Stealer Comes Wrapped Like a Legit App
A reported Lucid Stealer build uses a Node.js Single Executable Application wrapper, showing how familiar software packaging can blur the line between benign delivery and criminal tooling.
Inside the Leaked Operator Stack: How One Exposed Workspace Turned AI Credentials Into Propaganda Fuel
Researchers described a threat actor alias linked to an exposed working environment, where Gemini API keys, Telegram automation, and fraud tooling appeared to support a broader influence operation.
When Laundering Turns Hybrid, the Trail Gets Longer - and Harder to Read
Criminal finance is increasingly described as a blend of cash, digital wallets, cryptocurrencies, and blockchain, a mix that changes both the hiding places and the clues investigators can use.