Underground Malware Operation Drains About $100,000 in Cryptocurrency

Oct 1, 2026 · Original article ↗

Summary

Netskope researchers detail a Windows malware operation that injects a Vidar-class stealer into browsers to drain exchange accounts and replace copied wallet addresses. They estimate about $100,000 in proceeds and at least 350–430 paying victims.

Key points

Aotera/Tedy loader builds deliver a Vidar-class stealer into a suspended dllhost.exe process; the injected process launches Chrome or Edge under the victim’s profile.
The malware injects scripts into logged-in browser sessions to drain exchange accounts, including disabling Binance withdrawal allow lists, converting funds to Bitcoin, and withdrawing them to operator-controlled addresses.
A clipboard clipper replaces copied cryptocurrency wallet addresses with the operator’s addresses; the configuration covers more than 80 destinations across roughly two dozen chains.
Netskope estimates at least $100,000 in on-chain proceeds and 350–430 paying victims; the victim count excludes exchange-account drains and is therefore likely higher.
The campaign uses rotating, Cloudflare-fronted gates and disguises withdrawal confirmation emails in webmail. Researchers did not attribute it to a named actor.
Blocking a gate does not remove the implant. Netskope recommends investigating endpoints for the loader’s process behavior and artifacts, and hunting for browser requests to /api/machine/* across any domain.
Netskope reports detections for the gate URI pattern, malicious gate domains, and loader binaries; it also disclosed live gate domains to Cloudflare.

Article Details

Attack Vectors: Versioned 7z or zip lure archives contain setup.exe, a trojanized msys-crypto-3.dll, and encrypted data.bin. How the archives reach victims is unknown.
The Underground loader decrypts an embedded stage and injects it into a suspended dllhost.exe process. That process launches Chrome or Edge under the victim’s existing browser profile.
The injected stealer obtains browser-injection scripts from a rotating gate and runs them in authenticated exchange and webmail sessions.
In a logged-in Binance session, an injected script displays a fake security-verification overlay while disabling the withdrawal allow list, converting balances, and withdrawing funds to operator addresses.
A clipboard clipper replaces copied cryptocurrency wallet addresses with operator addresses. Webmail injections alter how withdrawal-confirmation messages appear in the victim’s browser.
Defensive Notes: Treat contact with a blocked gate as evidence of an active infection: blocking traffic does not remove the implant, and infected machines may continue polling.
Hunt for injection into dllhost.exe, Chrome or Edge launched by dllhost.exe, activity in C:\ProgramData\Underground\, and PNG-named artifacts in AppData\Local. The malware may delete the Underground folder after use.
Use behavioral detection for chrome.exe or msedge.exe requests to /api/machine/* alongside domain reputation, because the operator rotates gate domains.
Verify exchange withdrawals through a separate channel; the payload can alter confirmation emails displayed in webmail.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`easybooters[.]com`	Operator C2 log domain used to report account-drain steps.
DOMAIN	`quick-neo[.]com`	Example of a hardcoded gate used by the stealer.
DOMAIN	`slow-sky[.]com`	Tracked gate domain that was serving the injection configuration during the investigation.
DOMAIN	`true-lie[.]com`	Tracked rotating gate domain.
IPV4	`95[.]164[.]53[.]76`	Underground loader telemetry-panel address.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/048466C5/startCrypt`	Recorded loader telemetry URL for the startCrypt stage.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/29A5FDA7/failed/1769331221`	Recorded loader telemetry URL for a failed stage.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/29A5FDA7/startLoader/1769331211`	Recorded loader telemetry URL for the startLoader stage.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/8320e1a4/startloader/1767499038`	Recorded loader telemetry URL for the startloader stage.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/8320E1A4/success/1767499039`	Recorded loader telemetry URL for a success stage.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/D9D278DD/success/1696492954`	Recorded loader telemetry URL for a success stage.
URL	`hxxps[:]//easybooters[.]com/newlog[.]php`	Configured operator log endpoint for reporting account-drain steps.