Court documents show that malware collected passwords, wallet credentials, browser data, and other sensitive information after users installed games. Discord, Telegram, X, and LinkedIn were used to promote these games, and automated bots searched online communities for users holding large amounts of cryptocurrency.