www.kaspersky.com Mars Stealer Malware Targets Crypto Wallets with New Tactics
Article Content
- •Mars Stealer malware can bypass 2FA and targets browser-based crypto wallets.
- •A Florida man was arrested for injecting this malware into free games on Steam.
- •The malware has already stolen over $220,000 from approximately 8,000 victims.
Mars Stealer, a new iteration of the Oski Trojan, is actively targeting browser-based cryptocurrency wallets. It can bypass two-factor authentication (2FA) and is available for purchase on the Dark Web for under $200. The malware can extract sensitive information such as crypto addresses and private keys from compromised devices. Recent incidents have shown that a Florida man, Zyaire Wilkins, injected this malware into free games on Steam, affecting around 8,000 devices and stealing over $220,000 in cryptocurrencies. The FBI arrested Wilkins and his accomplices in July 2026 after tracking on-chain transactions back to them. The malware is particularly dangerous as it can uninstall itself if it detects a device from certain countries, evading detection. Security experts warn that users must remain vigilant against such threats.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Mars Stealer in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
How does Mars Stealer operate?
Who is at risk from this malware?
What should users do to protect themselves?
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…
Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…