New Malware Emerges That Targets Coinbase Wallet, MetaMask and Other Crypto Extensions: Report

A new type of malware has surfaced that can compromise crypto wallets and extensions, putting investors at risk of hacks.

According to a new blog post by network security expert 3xp0rt, a piece of malware known as Mars Stealer – an improved version of information bootlegger Oski Stealer – has emerged to prey on web browsers, crypto extensions and crypto wallets.

Some of the popular web browsers the malware affects are Internet Explorer, Firefox, Microsoft Edge and Thunderbird.

It also preys on crypto extensions such as MetaMask, TronLink, Binance Chain Wallet and Coinbase Wallet while also targeting wallets such as Bitcoin Core and its derivatives. Wallets under MultiDoge and Ethereum could also potentially be affected.

However, 3xp0rt notes that the malware only targets crypto extensions on Chromium-based browsers other than Opera.

The cybersecurity expert says that Mars Stealer operates by getting a handle of a computer’s internal library files to conduct a complex series of technical coding reconfigurations to do its bidding.

To steal a user’s wallet information, the malware targets sensitive data stored in the wallet.dat file. The file contains information such as the address and private key access data, according to the internet security expert. The malware also has a built-in grabber, loader, and self-removal feature.

“Mars Stealer is an improved version of Oski Stealer. [It] has added [functionality]: anti-debug check, crypto extension stealing, but Outlook stealing is missing. The code has been refactored, but some algorithm remained stupid as in Oski Stealer.”