Enoch Harring H4mC

Microsoft has identified a new remote access trojan (RAT) designed to steal cryptocurrency from users by targeting digital wallet extensions on Google Chrome.
The malware, dubbed StilachiRAT, has been under investigation since November 2024, and security experts warn it poses a significant threat to crypto holders.
How StilachiRAT Operates
According to Microsoft’s Incident Response Team, StilachiRAT is capable of extracting credentials stored in the browser, scanning devices for crypto wallet extensions, and intercepting sensitive information such as private keys and passwords.
The malware has been found to specifically target at least 20 cryptocurrency wallets, including Bitget Wallet (formerly BitKeep), Trust Wallet, Coinbase Wallet, MetaMask, TronLink and OKX Wallet. Once deployed, it can steal stored digital assets by accessing clipboard data and extracting private credentials.
Microsoft’s research indicates that StilachiRAT operates stealthily, using various evasion techniques to avoid detection. The malware installs itself through a compromised library file, WWStartupCtrl64.dll, which executes remote commands to manipulate infected systems.
Once active, it scans the device for crypto wallet extensions and extracts saved credentials from Google Chrome’s local state files. A key feature of the malware is its ability to monitor clipboard activity, meaning if users copy and paste crypto wallet addresses or passwords, StilachiRAT can capture and redirect that information to the attacker.
Microsoft also found that the trojan includes anti-forensic capabilities, such as clearing event logs and detecting sandbox environments to avoid being analyzed by cybersecurity researchers.
Microsoft’s Response and Security Recommendations
At present, Microsoft has not attributed the attack to any specific hacker group but has warned that due to the nature of the malware ecosystem, StilachiRAT could evolve rapidly.  In a blog post, the company stated:
Based on Microsoft’s current visibility, the malware does not exhibit widespread distribution at this time. However, due to its stealth capabilities and the rapid changes within the malware ecosystem, we are sharing these findings as part of our ongoing efforts to monitor, analyze, and report on the evolving threat landscape.
Microsoft advises users to take precautionary measures to avoid falling victim to StilachiRAT and similar threats. The company recommends installing antivirus software, enabling cloud-based anti-phishing and anti-malware protection, and ensuring all browser extensions come from trusted sources.
Users should also be cautious when copying and pasting wallet addresses and passwords, as malware like StilachiRAT specifically exploits clipboard data.
With increasing security risks in the crypto space, Microsoft’s warning highlights the importance of staying vigilant against cyber threats. As hackers develop more advanced techniques to compromise digital wallets, investors and everyday users must take proactive steps to secure their assets.
#Write2Earn
#HackerAlert

OKX Suspends DEX Service Amid Security Upgrades Linked to North Korea Laundering Allegations
In a significant move within the cryptocurrency ecosystem, OKX, one of the world’s leading crypto exchanges, has announced the suspension of its decentralized exchange (DEX) service. The decision, revealed on March 17, 2025, comes as the platform undertakes critical security upgrades. The suspension has drawn widespread attention due to reports that the DEX service was allegedly exploited by North Korean actors to launder funds stolen in a high-profile hack targeting Bybit, another prominent cryptocurrency exchange.
Background on the Suspension
OKX’s DEX, a platform that facilitates peer-to-peer crypto trading without intermediaries, has been a popular feature for users seeking privacy and autonomy in their transactions. However, the decentralized nature of such services has also made them a target for illicit activities. According to sources familiar with the matter, OKX’s decision to halt the service stems from the need to bolster its infrastructure against vulnerabilities exposed by recent events.
While OKX has not officially confirmed the specifics of the security upgrades, the timing of the suspension aligns with emerging reports tying the platform to a broader cybersecurity scandal. Blockchain analysts and security firms have pointed to evidence suggesting that North Korean hackers, notorious for their sophisticated cyber operations, leveraged OKX’s DEX to obscure the trail of stolen funds.
The Bybit Hack Connection
The Bybit hack, which occurred earlier this year, saw cybercriminals siphon off millions of dollars in digital assets from the exchange’s hot wallets. Bybit, a Singapore-based platform known for its derivatives trading, disclosed the breach in late 2024, attributing it to a coordinated attack by a state-sponsored group. Subsequent investigations by blockchain forensics teams, including firms like Chainalysis, traced a portion of the stolen funds through a complex web of transactions.
Reports indicate that the hackers funneled the illicit proceeds into OKX’s DEX, taking advantage of its decentralized architecture to mix the stolen assets with legitimate funds—a process known as laundering. North Korea, long accused of using cryptocurrency theft to fund its regime and circumvent international sanctions, has been implicated as the orchestrator of the scheme. The rogue state’s hacking collectives, such as the Lazarus Group, have been tied to numerous high-profile crypto heists in recent years, amassing hundreds of millions in ill-gotten gains.
OKX’s Response and Industry Implications
OKX has framed the suspension as a proactive step to safeguard its users and enhance the platform’s resilience. In a statement released on March 17, 2025, the exchange emphasized its commitment to maintaining a secure trading environment. “We are temporarily pausing our DEX service to implement critical upgrades that will strengthen our systems and protect our community,” the statement read. The company did not directly address the North Korea allegations but assured users that the service would resume once the improvements are complete.
The move has sparked debate within the crypto community. Proponents of decentralization argue that suspending the DEX undermines the ethos of user sovereignty, while others commend OKX for taking decisive action to mitigate risks. The incident also raises questions about the broader challenges facing decentralized platforms, which often struggle to balance openness with regulatory and security demands.
North Korea’s Crypto Laundering Playbook
North Korea’s alleged involvement in the OKX DEX case fits a well-documented pattern. The regime has increasingly turned to cryptocurrency as a means of generating revenue amid crippling economic sanctions. By targeting exchanges like Bybit and using platforms like OKX’s DEX to launder the proceeds, Pyongyang has demonstrated a sophisticated understanding of blockchain technology and its loopholes.
Security experts note that DEXs are particularly appealing to bad actors due to their lack of centralized oversight and know-your-customer (KYC) requirements. This allows hackers to swap stolen tokens for other cryptocurrencies, such as privacy-focused coins like Monero, before moving them to untraceable wallets. The OKX suspension may prompt other exchanges to reevaluate their own DEX offerings as regulators and law enforcement intensify efforts to curb such activities.
What’s Next for OKX and the Crypto Sector?
As OKX works to fortify its DEX, the exchange faces pressure to provide clarity on the timeline for resuming operations and the nature of the upgrades. Users affected by the suspension have expressed frustration on social media, with some speculating that the pause could extend for weeks or longer. Meanwhile, Bybit continues its efforts to recover the stolen funds and collaborate with authorities to bring the perpetrators to justice.
The incident serves as a stark reminder of the persistent security challenges in the cryptocurrency industry. With state-sponsored actors like North Korea exploiting vulnerabilities, exchanges—centralized and decentralized alike—must adapt to an evolving threat landscape. For OKX, the suspension may be a temporary setback, but it underscores the delicate balance between innovation, security, and accountability in the world of digital finance.
As the situation develops, the crypto community will be watching closely to see how OKX navigates this crisis and whether its actions set a precedent for other platforms grappling with similar risks. For now, the suspension stands as a bold, if controversial, step in the ongoing battle to secure the future of decentralized trading.
#BybitHackLaunderingInvestigation