How StilachiRAT Malware Threatens Your Crypto Wallet Security

Microsoft’s incident response team has identified a new remote access trojan (RAT), dubbed StilachiRAT, that presents a significant risk to cryptocurrency users.

StilachiRAT is capable of gathering system data, pilfering login information, and extracting sensitive details from digital wallets. Although it remains relatively contained at present, the potential repercussions have raised alarm within the cryptocurrency community.

Understanding the Threat of StilachiRAT to Crypto Investors

This malware is not merely another software threat; it signifies a new chapter in cyber attacks directed at digital assets.

As noted by Microsoft, once StilachiRAT breaches a system, it immediately begins a reconnaissance phase. It collects vital information regarding the operating system, hardware identifiers, webcam presence, and any active Remote Desktop Protocol (RDP) sessions. Following this, it turns its attention towards stealing credentials saved in Chrome and data in the clipboard, where users often copy passwords or wallet keys.

StilachiRAT selectively targets 20 cryptocurrency wallet extensions available on Google Chrome. Notable wallets vulnerable to this attack include Metamask, Trust Wallet, Coinbase Wallet, TronLink, TokenPocket, BNB Chain Wallet, OKX Wallet, Sui Wallet, and Phantom.

“StilachiRAT specifically targets a pre-defined list of cryptocurrency wallet extensions for the Google Chrome browser. It verifies the settings in corresponding registry keys to check for installed extensions,” explained Microsoft.

The report issued by Microsoft emphasizes StilachiRAT’s sophisticated anti-forensic features. The trojan is capable of deleting event logs and examining system states to evade detection.

To safeguard against this threat, Microsoft recommends that users download software exclusively from official sources and remain cautious of dubious websites or email attachments. Activating real-time protection via Microsoft Defender and utilizing browsers equipped with SmartScreen can aid in blocking malicious sites.

Moreover, enabling multi-factor authentication (MFA) and routinely updating software are essential measures to mitigate risks.

“In some instances, remote access trojans (RATs) may disguise themselves as legitimate software or updates. Always obtain software from the official website of the developer or from trusted sources,” Microsoft cautioned.

According to Chainalysis’ report on Crypto Crime Trends 2025, illicit cryptocurrency transactions are estimated to total between $40 billion and $50 billion annually. These amounts are often acquired through various illegal methods, including ransomware and malware assaults.

Chainalysis further predicts that the volume of illicit transactions could surpass $51 billion in 2024, with an average annual growth rate of 25% between reporting periods.