Malware concealed inside downloadable games allegedly harvested credentials that attackers used to enter cryptocurrency accounts and remove victims’ digital assets. Local 10 News first reported the case on July 15, citing a 15-page federal criminal complaint that outlined the alleged malware scheme.
The complaint alleges that the operation ran from May 2024 through February 2026, compromising roughly 8,000 devices through eight infected games. Federal investigators accuse Zyaire Dontaevious Zamarion Wilkins, 21, of North Lauderdale, Florida, of providing financial support for the malware operation and helping promote the campaign.
Discord, Telegram, X, and LinkedIn allegedly became marketing channels for the infected games, while automated bots reportedly searched online communities for people with significant cryptocurrency holdings. The targeted account holders then received customized messages encouraging them to install the software.
After infecting a device, the malware allegedly searched for login credentials, cryptocurrency wallet information, and authentication data. Investigators maintain that members of the conspiracy examined the stolen files and identified wallets they could access and drain.
Encrypted Signal conversations allegedly showed Wilkins using the handle “Sibel.eth” while communicating with the suspected primary malware developer. According to the complaint, those exchanges included discussions about purchasing a $10,000 remote access trojan and conducting campaigns designed to empty victims’ cryptocurrency wallets.
Bitcoin transactions linked to the alleged operation eventually led investigators to Bitrefill, where more than 150 digital gift cards were allegedly purchased using cryptocurrency tied to the scheme. Most were redeemed for Uber Eats orders, and subpoenaed records connected deliveries to Wilkins’ university addresses and his South Florida residence.
Agents executing a search warrant recovered electronic devices and three cryptocurrency wallet seed phrases, including one allegedly associated with a Monero wallet.
Transaction records reviewed by authorities allegedly showed that Wilkins sent or received approximately $382,000 in cryptocurrency. He now faces one count of conspiracy to obtain computer information for private financial gain, an offense carrying a maximum sentence of 10 years in prison.