Hackers Are Using Fake Crypto Wallet Screens to Steal Recovery Phrases and Browser Sessions

Cybersecuritynews •Tushar Subhra Dutta • July 28, 2026

Criminals are using convincing cryptocurrency wallet screens and browser extensions to steal recovery phrases, login data, and active browser sessions. The activity is linked to a wider CastleLoader campaign that gives attackers several ways to gain access to infected Windows devices. The operation starts with fake software installers and ClickFix-style prompts that pressure victims into […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CastleLoader Campaign Uses NeedleStealer to Target Crypto Users The CastleLoader malware campaign has evolved, deploying the NeedleStealer framework to steal cryptocurrency wallet seed phrases and hijack browser sessions. This operation targets Windows devices through fake software installers and deceptive prompts. Recent findings from Huntress and LevelBlue confirm that CastleLoader remains a primary delivery mechanism for multi-stage intrusions. Attackers use convincing fake wallet screens and browser extensions to harvest sensitive information. The scope of the attack is significant, affecting numerous users who interact with cryptocurrency applications. Current reports indicate that the campaign is ongoing, with new tools developed in Rust and Golang being utilized. Security professionals are advised to remain vigilant against these tactics. 2 sources 67

Extracted Entities

Hackers Are Using Fake Crypto Wallet Screens to Steal Recovery Phrases and Browser Sessions

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)