New Malware Poses as Roblox Mods to Steal Crypto Credentials – Decrypt

Hackers are inserting infostealer malware into pirated mods for Roblox and different video games, based on analysis from cybersecurity firm Kaspersky.

A weblog publish from Kaspersky reveals that it has recognized a brand new number of infostealer known as Stealka, which it has thus far encountered on distribution platforms akin to GitHub, SourceForge, Softpedia and websites.google.com.

Disguised as unofficial mods, cheats and cracks for Home windows-based video games and different apps, Stealka exfiltrates delicate login and browser data, which its operators can use to steal crypto.

Crypto wallets focused

The malware primarily targets information contained by browsers akin to Chrome, Firefox, Opera, Yandex Browser, Edge, Courageous, in addition to the settings and databases of over 100 browser extensions.

Such extensions embrace cryptocurrency wallets from Binance, Coinbase, MetaMask, Crypto.com and Belief Pockets, in addition to password managers (1Password, NordPass, LastPass) and 2FA apps (Google Authenticator, Authy, Bitwarden).

In truth, Stealka’s attain doesn’t cease with browser extensions, since it will probably additionally elevate (encrypted) personal keys, seed phrase information and pockets file paths from standalone cryptocurrency pockets apps.

This contains apps from Binance, Exodus, MyCrypto and MyMonero, in addition to pockets apps for Bitcoin, BitcoinABC, Dogecoin, Ethereum, Monero, Novacoin and Photo voltaic.

Away from crypto, the Stealka malware has the flexibility to steal information and authentication tokens for messaging apps (e.g. Discord and Telegram), password supervisor apps (e.g. 1Password, Bitward, LastPass), e mail shoppers (e.g. Gmail Notifier Professional, Mailbird, Outlook), notetaking apps (NoteFly, Notezilla, Microsoft StickyNotes), and VPN shoppers (e.g. OpenVPN, ProtonVPN, WindscribeVPN).

Talking to Decrypt, Kaspersky cybersecurity skilled Artem Ushkov defined that the brand new malware “was detected by Kaspersky endpoint safety options on Home windows machines in November 2025.”

As is the case with comparable malware, Ushkov experiences that many of the customers focused by Stealka are based mostly in Russia.

“Nevertheless, assaults by the malware have additionally been detected in different international locations, together with Türkiye, Brazil, Germany and India,” he added.

The right way to keep protected

In view of the menace Stealka, Kaspersky advises in its weblog that, apart from utilizing respected antivirus software program, customers ought to keep away from unofficial and pirated mods.

The weblog additionally advises towards storing necessary information in browsers, and urges customers to make use of two-factor authentication wherever accessible, whereas additionally making use of backup codes (however with out storing them on browsers or in textual content paperwork).

Whereas Stealka’s potential for stealing information and, by extension, crypto appears intimidating, there’s presently no indication that it has resulted in important losses.

“We aren’t conscious of the quantity of crypto that has been stolen utilizing it,” mentioned Ushkov. “Our options defend towards this menace: all detected Stealka malware was blocked by our options.”