Malware steals over $235K in crypto from hundreds of victims in just 48 hours

A remote access trojan has stolen more than $235,000 in cryptocurrency from hundreds of victims over a 48-hour window. The attack, reported on September 20, 2026, represents low-profile, high-volume cybercrime that quietly inflicts real damage across the crypto ecosystem. What we know about the attack This particular campaign leveraged standard RAT capabilities, including credential harvesting and session manipulation. Credential harvesting means the malware captures usernames and passwords as victims type them. Session manipulation goes a step further, allowing attackers to piggyback on active browser sessions to bypass authentication entirely. The victim count, numbering in the hundreds, points to a broad and automated distribution strategy rather than a carefully targeted spear-phishing operation. The specific distribution vector in this case hasn’t been publicly identified. No particular malware variant has been named. No specific threat actor or group has claimed responsibility or been attributed. And no law enforcement agency has publicly acknowledged an investigation. Why RATs remain crypto’s quiet nemesis RATs are effective against crypto holders for structural reasons. Mos...