- Trending
- Comments
- Latest
Cybercriminals are using fake gaming modifications and cheats to distribute malware that targets cryptocurrency wallets, with one newly identified strain capable of stealing credentials from more than 80 digital wallet extensions.
The threat comes as U.S. prosecutors charged a Brooklyn man with stealing $16 million from approximately 100 Coinbase users through an elaborate phishing scheme, highlighting how both technical and social engineering attacks are converging to drain crypto funds.
Fake Game Mods sit at the center of a new malware campaign uncovered by cybersecurity firm Kaspersky, which recently identified an infostealer dubbed “Stealka.”
First detected in November, Stealka is designed to quietly harvest sensitive data from infected Windows systems, with a particular focus on cryptocurrency wallets and browser-stored credentials.
According to Kaspersky, attackers are distributing Stealka by disguising it as Fake Game Mods, cheats, cracks, and pirated software linked to popular titles such as Roblox, as well as unauthorized versions of legitimate programs like Microsoft Visio.
By embedding the malware in Fake Game Mods, attackers take advantage of users seeking shortcuts or enhancements, a behavior common in gaming communities.
What makes the campaign especially effective is its distribution strategy. Stealka has been uploaded to widely trusted platforms including GitHub, SourceForge, and Google Sites, lending Fake Game Mods an appearance of legitimacy.
In some cases, attackers went further by creating polished fake websites that closely resemble authentic software download pages.
“These fake sites look professional and trustworthy, making them difficult for users to distinguish from real ones,” — Artem Ushkov, Researcher, Kaspersky.
Once installed through Fake Game Mods, Stealka can hijack online accounts, steal cryptocurrency, and even deploy crypto miners on victims’ devices without their knowledge, increasing both financial and operational risks.
The technical reach of Stealka underscores why Fake Game Mods pose a serious concern for crypto investors and policymakers alike. The malware primarily targets browsers built on Chromium and Gecko engines, placing more than 100 browsers at risk, including Chrome, Firefox, Edge, Brave, Opera, and others.
Stealka harvests browser autofill data, enabling it to capture login credentials, addresses, and payment card information. More critically for the crypto sector, it extracts data from browser extensions. Kaspersky estimates the malware can pull information from the settings and databases of 115 extensions.
Among these are roughly 80 cryptocurrency wallets, including Binance, Coinbase, Crypto.com, MetaMask, Trust Wallet, Phantom, and Exodus. Fake Game Mods carrying Stealka can also compromise password managers, two-factor authentication tools, messaging apps such as Discord and Telegram, VPNs, and gaming clients.
Kaspersky advised users to avoid pirated software and unofficial Fake Game Mods, use reputable antivirus solutions, and rely on dedicated password managers rather than browser-based storage.
These recommendations reflect broader concerns about consumer behavior and the need for stronger digital hygiene as crypto adoption grows.
Malware spread through Fake Game Mods is only one side of the threat landscape. Separately, U.S. prosecutors charged a 23-year-old Brooklyn resident, Ronald Spektor, with orchestrating a phishing scheme that allegedly stole approximately $16 million in cryptocurrency from about 100 Coinbase users.
According to the Brooklyn District Attorney’s Office, Spektor faces 31 criminal counts, including first-degree grand larceny and money laundering, for a scheme that ran from April 2023 to December 2024.
Prosecutors allege he impersonated a Coinbase customer support representative, contacting victims and warning them their accounts were under imminent threat.
By exploiting fear and urgency, Spektor allegedly convinced victims to transfer funds into new wallets he controlled. Authorities say he then laundered the stolen crypto through mixers, token-swapping services, and online gambling platforms. Losses were severe, including more than $1 million taken from a California victim and over $900,000 from a victim in Virginia.
“Those who target our customers will be pursued and held accountatble,” — Brian Armstrong, CEO, Coinbase.
Investigators recovered about $105,000 in cash and roughly $400,000 in cryptocurrency, and interviewed more than 70 victims during the probe. Blockchain investigator ZachXBT played a key role after publishing an investigation in November 2024 at the request of a victim who lost $6 million.
Together, the Stealka malware campaign and the Coinbase phishing case illustrate how Fake Game Mods and social engineering tactics are eroding trust in the crypto ecosystem.
For investors, the incidents reinforce the risks associated with self-custody and browser-based wallets. For policymakers, they raise questions about platform accountability, consumer protection, and the role of trusted hosting services in distributing malicious content.
As Fake Game Mods continue to blur the line between legitimate software and cybercrime tools, experts warn that education, enforcement, and cross-platform cooperation will be essential to limit further damage.
