ElectroRAT Campaign Used Fake Crypto Firms and Trojanized Apps to Steal Wallets

Attackers ran a large-scale cryptocurrency theft campaign built around ElectroRAT, a custom Golang remote access trojan hidden inside trojanized apps branded as Jamm, eTrade, and DaoPoker. The malware was distributed through dedicated websites, fake company fronts, forum accounts, social media personas, and paid promotion, targeting users on Windows, Linux, and macOS. Researchers said the operation had been active since at least January 2020 and likely reached thousands of victims, based in part on roughly 6,500 unique visitors to Pastebin pages used to retrieve command-and-control details.

Once installed, ElectroRAT ran covertly in the background as mdworker and gave operators broad surveillance and theft capabilities, including keylogging, screenshot capture, file upload and download, and remote command execution. The campaign’s infrastructure also showed ties to Amadey and the KPOT stealer, suggesting overlap with established criminal tooling, while the custom malware itself reportedly evaded antivirus detection for nearly a year. The operation highlights how convincing crypto-themed brands and cross-platform Electron applications were used to lure investors into installing malware that enabled wallet compromise and broader system access.