Underground Malware Operation Drains Crypto Accounts Through Injected Browser Sessions

Oct 1, 2026 · Original article ↗

Summary

Netskope details an Aotera/Tedy loader delivering a Vidar-class stealer that hijacks browser sessions to drain crypto accounts and replace copied wallet addresses. Researchers estimate about $100,000 stolen from at least 350–430 victims.

Key points

Victims are infected through lure archives containing setup.exe, a trojanized DLL, and encrypted data; how the archives are distributed is unknown.
The loader injects its payload into dllhost.exe, then launches Chrome or Edge under the victim’s profile to access authenticated sessions.
The Vidar-class stealer collects browser credentials, cookies, messaging data, wallet information, and screenshots.
Injected scripts drain Binance accounts by disabling withdrawal allow lists, converting balances to Bitcoin, and withdrawing funds; webmail injections disguise confirmation messages.
A clipboard clipper replaces copied wallet addresses with operator-controlled addresses across multiple cryptocurrencies.
The campaign uses rotating Cloudflare-fronted gates, including quick-neo[.]com, and a custom /api/machine/* protocol.
Researchers estimate roughly $100,000 in proceeds and at least 350–430 victims. Blocking a gate does not remove the implant; Netskope recommends endpoint checks and behavioral URI detection.

Article Details

Attack Vectors: Victims open versioned 7z or zip lure archives containing setup.exe, a trojanized msys-crypto-3.dll, and encrypted data.bin; how the archives reach victims is unknown.
The loader injects a self-decrypting payload into suspended dllhost.exe, which launches Chrome or Edge under the victim's browser profile and injects scripts into authenticated sessions.
Injected browser scripts automate cryptocurrency exchange account draining and disguise withdrawal-confirmation emails in webmail.
A clipboard clipper replaces copied cryptocurrency wallet addresses with operator-controlled addresses.
Defensive Notes: Treat contact with a blocked gate as an active infection; blocking network traffic does not remove the implant.
Hunt for dllhost.exe injection, Chrome or Edge launched by dllhost.exe, /api/machine/* requests, and files or PNG-named artifacts associated with C:ProgramDataUnderground and AppDataLocal.
Use behavioral URI detection alongside domain reputation because the operator rotates gate domains.
Verify exchange withdrawals through a separate channel because injected webmail scripts can rewrite confirmation messages.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`easybooters[.]com`	Operator log endpoint domain used to report account-drain steps.
DOMAIN	`quick-neo[.]com`	Rotating gate domain used by the malware's command-and-control protocol.
DOMAIN	`slow-sky[.]com`	Rotating malicious gate domain serving the operator's configuration.
DOMAIN	`true-lie[.]com`	Rotating gate domain used by the operation.
IPV4	`95[.]164[.]53[.]76`	Underground loader telemetry panel used to record loader-stage events.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/048466C5/startCrypt`	Loader telemetry URL used to report a startCrypt event.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/29A5FDA7/failed/1769331221`	Loader telemetry URL used to report a failed stage.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/29A5FDA7/startLoader/1769331211`	Loader telemetry URL used to report a startLoader event.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/8320e1a4/startloader/1767499038`	Loader telemetry URL used to report a startloader event.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/8320E1A4/success/1767499039`	Loader telemetry URL used to report a successful stage.
URL	`hxxp[:]//95[.]164[.]53[.]76/new/log/D9D278DD/success/1696492954`	Loader telemetry URL used to report a successful stage.
URL	`hxxps[:]//easybooters[.]com/newlog[.]php`	Operator log endpoint identified in the deobfuscated Binance-drain configuration.