MALICIOUS (1) campaign cataloged at 2026-08-04(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-08-psbt-utils¶
The code advertised as a firmware upgrader for hardware wallets in fact downloads an infostealer. The stealer searches the machine for cryptocurrency sensitive data (wallet files, seeds), browser data (passwords, cookies), all kinds of credentials (including tokens, passwords, SSH keys, TOTP seeds etc.), other sensitive files and current clipboard content. Data are exfiltrated, and the stealer configures persistence via scheduled tasks or LaunchAgent. The code deliberatly doesn't start in CI environments and checks if the system looks real.
Continuation of 2026-08-coldcard-helpers campaign.
Abuse categories¶
clipboard_stealing
Campaign uses clipboard_stealing.
crypto-related
Malicious activity is related to cryptocurrencies or blockchain, e.g. stealing crypto wallets.
exfiltration_browser_data
Campaign uses exfiltration_browser_data.
exfiltration_cloud_tokens
Campaign uses exfiltration_cloud_tokens.
exfiltration_credentials
The package attempts to steal credentials, like passwords or API keys.
exfiltration_crypto
The package attempts to steal sensitive cryptocurrency-related data, like wallet keys.
exfiltration_ssh_keys
Campaign uses exfiltration_ssh_keys.
files_exfiltration
Campaign uses files_exfiltration.
infostealer
Activity is typical for information stealers, i.e. by exfiltrate various sensitive data from the victim's environment.
obfuscation
Code uses obfuscation techniques to hide its true purpose.
persistence
Campaign uses persistence.
remote_script
Downloads and executes a remote malicious script.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
-
hxxps://curly-violet-87a9.ricardorichp.workers.dev/firmware -
curly-violet-87a9.ricardorichp.workers.dev