Briefing
A new, sophisticated two-stage malware operation, identified as LeakyInjector and LeakyStealer, is actively targeting user endpoints to compromise digital asset holdings. LeakyInjector acts as the initial vector, utilizing low-level API injection to evade standard security protocols before deploying the second-stage LeakyStealer payload into the explorer.exe process. The primary consequence is the systematic reconnaissance and data exfiltration of credentials and private keys from multiple browser-based crypto wallet extensions. This highly methodical attack represents a critical escalation in user-side threat complexity, moving beyond simple phishing to deep system infection.
Context
The prevailing risk for most retail and institutional users has long been the compromise of browser-based wallet extensions, which maintain hot keys and are vulnerable to process-level attacks. Prior to this new family, many threat actors relied on simpler phishing or social engineering to acquire seed phrases, making the attack surface primarily human-centric. This new malware shifts the attack vector to the operating system’s process space, indicating a failure of traditional endpoint detection systems to flag the initial low-level injection.
Analysis
The attack chain begins with LeakyInjector, which leverages low-level Windows APIs to achieve stealthy code injection, effectively bypassing basic heuristic detection mechanisms. Once established, LeakyInjector injects the LeakyStealer payload directly into a core system process, specifically explorer.exe , to mask its malicious activity as legitimate system function. LeakyStealer then performs targeted reconnaissance, scanning the infected machine for files associated with numerous crypto wallet browser extensions and the user’s browser history.
This allows the malware to systematically harvest sensitive data, including session tokens, private keys, and potentially seed phrases, for subsequent exfiltration and asset theft. The success of the exploit hinges on the stealth of the initial injection and the co-opting of a trusted system process.
Parameters
Outlook
Users must immediately audit all active browser extensions, revoke permissions for non-essential applications, and ensure all operating system and antivirus software is updated to the latest versions capable of detecting low-level API calls. This incident establishes a new, higher baseline for required endpoint security, moving the focus from network-level phishing to deep-seated process injection. Protocols and dApps must now consider the security of the user’s endpoint as a critical component of their overall risk model, potentially leading to the adoption of more robust hardware-wallet-only transaction signing requirements.
Verdict
The emergence of the LeakyStealer family signifies a critical shift from human-centric social engineering to sophisticated, system-level malware, demanding an immediate and complete overhaul of user endpoint security protocols.
