New EtherRAT Variant Uses Trojanized Tftpd64 Installer to Bridge Web2 Malware and Web3 Theft

Cybersecuritynews •Tushar Subhra Dutta • April 30, 2026

A new and more dangerous type of malware is quietly targeting Windows users by hiding inside a trusted software installer. Cybercriminals have combined traditional malware tactics with cryptocurrency theft, creating a threat that is harder to detect and far more destructive than what most users expect. For years, traditional malware and crypto-focused attacks operated in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New EtherRAT Malware Variant Targets Windows Users via Trojanized Installer A sophisticated variant of the EtherRAT malware has been identified, delivered through a compromised version of the TFTP server tool, Tftpd64. Cybercriminals are targeting IT administrators and network professionals by embedding this malware in a trojanized installer from a spoofed GitHub repository. Once executed, the malware establishes a hidden directory and deploys a Node.js runtime to evade detection. It then conducts system reconnaissance and targets Ethereum RPC endpoints and wallet addresses for cryptocurrency theft. Organizations are advised to download software only from official sources and monitor suspicious registry entries. The attack combines traditional malware techniques with cryptocurrency theft, making it particularly dangerous. The scope of impact is significant, affecting users who may unknowingly download the malicious installer. Current status indicates ongoing risks as the malware remains undetected by many security tools. 3 sources 68

Extracted Entities

New EtherRAT Variant Uses Trojanized Tftpd64 Installer to Bridge Web2 Malware and Web3 Theft

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)