As the price of Bitcoin continues its upward trajectory, cybercriminals are deploying increasingly sophisticated schemes to exploit the crypto boom. Security firm Intezer Labs has revealed a year-long malware campaign that uses three fraudulent cryptocurrency applications to spread a dangerous remote access tool (RAT) known as ElectroRAT, draining victims' digital wallets.
Fake Apps Disguised as Trading and Poker Platforms
According to Intezer Labs' research, the threat actors rely on three applications: Jamm (a fake crypto trading platform), eTrade/Kintum (another bogus trading app), and DaoPoker (a fake crypto poker game). What sets this campaign apart is that the attackers have developed versions for Windows, Mac, and Linux, aiming to increase victim confidence and expand their reach across global platforms. This cross-platform approach is uncommon in typical malware operations and indicates significant planning and resources.
The malicious apps are promoted through crypto-themed forums such as BitcoinTalk and Steemcoinpan, as well as fake social media accounts. The attackers create convincing user profiles that engage in discussions and post links to download the infected applications. Once a user installs and runs any of these apps, the ElectroRAT malware is activated, giving attackers remote control over the victim's device.
ElectroRAT's Capabilities: Keylogging, Screenshots, and Remote Commands
Intezer Labs describes ElectroRAT as an extremely intrusive malware with a wide range of capabilities. It can log keystrokes to capture passwords and private keys, take screenshots of the user's screen, upload files from the disk, download additional payloads, and execute commands on the victim's console. These features enable attackers to stealthily extract cryptocurrency wallet credentials, seed phrases, and any sensitive information stored on the device. The same capabilities are available across all three operating systems (Windows, Mac, Linux), making it a truly multi-platform threat.
The security firm notes that it is “very uncommon” to see this kind of malware targeting cryptocurrency users, and even rarer to encounter such a comprehensive campaign that includes fake applications, dedicated websites, social media marketing, and forum promotions. The campaign is believed to have affected thousands of victims worldwide, with the number likely to rise as the malware continues to spread.
How to Stay Safe: Download Only from Official Sources
Intezer Labs advises cryptocurrency users to exercise extreme caution when downloading any cryptocurrency-related applications. The fake apps are designed to look legitimate, mimicking the user interface of popular platforms. Users should only download apps from official app stores (Google Play, Apple App Store) or directly from the project's verified website. Avoid clicking on links shared in forums or social media posts that promote “exclusive” or “new” trading or gaming apps. Additionally, running antivirus scans and monitoring system behavior can help detect suspicious activity before funds are compromised.
The discovery of ElectroRAT highlights a growing trend: bull markets in cryptocurrency often attract more sophisticated cybercrime. As digital asset prices rise, so does the incentive for hackers to target unsuspecting investors. Staying informed and maintaining strong security practices are essential for protecting one's crypto holdings.