BTC
$104,893.96
+
0.22%
ETH
$2,547.91
-
0.85%
USDT
$1.0003
+
0.02%
XRP
$2.1976
+
0.57%
BNB
$660.92
-
0.50%
SOL
$157.76
-
1.42%
USDC
$0.9997
-
0.01%
DOGE
$0.1951
-
1.96%
TRX
$0.2663
-
1.76%
ADA
$0.6930
-
1.83%
HYPE
$32.93
-
1.69%
SUI
$3.2798
-
1.05%
LINK
$14.15
-
0.25%
AVAX
$21.08
-
0.02%
XLM
$0.2667
-
1.40%
BCH
$417.89
+
2.52%
LEO
$8.6047
-
2.29%
TON
$3.1572
-
4.04%
SHIB
$0.0₄1289
-
1.62%
HBAR
$0.1687
-
1.29%
Logo
  • News
  • Prices
  • Data
  • Indices
  • Research
  • Events
  • Sponsored
  • Sign In
  • Sign Up
Markets
Share this article
X iconX (Twitter)LinkedInFacebookEmail

New Malware Swaps Out Crypto Wallet Addresses as You Type Them

A newly discovered piece of malware can secretly steal your crypto wallets and passwords.

By John Biggs
Updated Dec 10, 2022, 8:08 p.m. Published Sep 27, 2019, 5:00 p.m.
default image

A new bit of malware called Masad Stealerhttps://forums.juniper.net/t5/Threat-Research/Masad-Stealer-Exfiltrating-using-Telegram/ba-p/468559 can replace wallet addresses as you type them thanks to malicious code injected into your browser. According to Juniper Networks, it also steals:

STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
By signing up, you will receive emails about CoinDesk products and you agree to our terms of use and privacy policy.
PC and system information





Credit Card Browser Data



Browser passwords



Installed software and processes



Desktop Files



Screenshot of Desktop



Browser cookies



Steam files



AutoFill browser fields



Discord and Telegram data



FileZilla files

The program dumps this information to the malware controller's Telegram account, ensuring relative security for the data it steals. It can also clip and change monero, litecoin, zcash, dash and ethereum addresses automatically and uses special search functions to pinpoint these addresses on your clipboard. Once it swaps the addresses it can intercept crypto as its being sent to legitimate wallets.

The particular version of the malware Juniper studied sent crypto to this wallet which currently contains almost a one full bitcoin.

"Based on our telemetry, Masad Stealer’s main distribution vectors are masquerading as a legitimate tool or bundling themselves into third party tools," wrote the research organization. "Threat actors achieve end user downloads by advertising in forums, on third party download sites or on file sharing sites."

The software masquerades as useful-looking software like Tradebot_binance.exe, Galaxy Software Update.exe, and Fortniteaimbot 2019.exe. Once infected, the computer then begins communicating with the command and control Telegram channel and sends back private data.

The malware allegedly costs $40 on the dark web and is completely configurable and very dangerous, said Juniper.

"Juniper Threat Labs believes that Masad Stealer represents an active and ongoing threat. Command and Control bots are still alive and responding as of this writing, and the malware appears to still be available for purchase on the black market," wrote the researchers.

Hacker image via Michael Geiger/Unsplash

SecurityMalwareNews
John Biggs

John Biggs is an entrepreneur, consultant, writer, and maker. He spent fifteen years as an editor for Gizmodo, CrunchGear, and TechCrunch and has a deep background in hardware startups, 3D printing, and blockchain. His work has appeared in Men’s Health, Wired, and the New York Times. He runs the Technotopia podcast about a better future.

He has written five books including the best book on blogging, Bloggers Boot Camp, and a book about the most expensive timepiece ever made, Marie Antoinette’s Watch. He lives in Brooklyn, New York.

Picture of CoinDesk author John Biggs
Latest Crypto News
Article image

Bitcoin Whales Seem to Be Calling a Top as BTC Price Consolidates

May 29, 2025

Bitcoin (BTC) price on May 19 (CoinDesk)

Bitcoin Climbs to $105K; Crypto ETF Issuer Sees 35% Upside

May 29, 2025

Breaking News

Breaking New test

May 29, 2025

FastNews (CoinDesk)

Fast News test

May 29, 2025

Article image

Ethereum Surges 4% on Massive Volume as Institutional Interest Grows.

May 27, 2025

Article image

test research article

May 22, 2025

Top Stories
President Donald Trump (TheDigitalArtist/Pixabay)

Bitcoin Poised to Top Record as Trump Inauguration Nears, Major Coins Due for 10% Swings: Traders

Jan 16, 2025

Screen Shot 2018-08-12 at 11.22.53 PM

In Rare Decision, ICO Founders Will Delay Crypto Paydays – For a Decade

Aug 13, 2018

(CJ/Unsplash)

XRP Futures Start Trading on CME

May 19, 2025

Credit: NASA

50 Cut as $60 Million Blockchain Project Nebulas Lays Off 60% of Staff

Jan 22, 2019

Bitcoin (BTC) price on May 19 (CoinDesk)

Bitcoin Climbs to $105K; Crypto ETF Issuer Sees 35% Upside

May 29, 2025

Breaking News

Breaking New test

May 29, 2025

Only 2 articles remaining this month.

Sign up for free

About

  • About Us
  • Masthead
  • Careers
  • CoinDesk News
  • Crypto API Documentation

Contact

  • Contact Us
  • Accessibility
  • Advertise
  • Sitemap
  • System Status
DISCLOSURE & POLICES
CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. CoinDesk has adopted a set of principles aimed at ensuring the integrity, editorial independence and freedom from bias of its publications. CoinDesk is part of the Bullish group, which owns and invests in digital asset businesses and digital assets. CoinDesk employees, including journalists, may receive Bullish group equity-based compensation. Bullish was incubated by technology investor Block.one.
EthicsPrivacyTerms of UseCookie SettingsDo Not Sell My Info

© 2025 CoinDesk, Inc.
X icon
Sign Up
  • News
    Back to menu
    News
    • Markets
    • Finance
    • Tech
    • Policy
    • Focus
  • Prices
    Back to menu
    Prices
    • Data
      Back to menu
      Data
      • Trade Data
      • Derivatives
      • Order Book Data
      • On-Chain Data
      • API
      • Research & Insights
      • Data Catalogue
      • AI & Machine Learning
    • Indices
      Back to menu
      Indices
      • Multi-Asset Indices
      • Reference Rates
      • Strategies and Services
      • API
      • Insights & Announcements
      • Documentation & Governance
    • Research
      Back to menu
      Research
      • Events
        Back to menu
        Events
        • Consensus Hong Kong
        • Consensus 2026
        • CoinDesk: Policy & Regulation
      • Sponsored
        Back to menu
        Sponsored
        • Thought Leadership
        • Press Releases
        • CoinW
        • MEXC
        • Phemex
        • Advertise
      • Videos
        Back to menu
        Videos
        • CoinDesk Daily
        • Shorts
        • Editor's Picks
      • Podcasts
        Back to menu
        Podcasts
        • CoinDesk Podcast Network
        • Markets Daily
        • Gen C
        • Unchained with Laura Shin
        • The Mining Pod
      • Newsletters
        Back to menu
        Newsletters
        • The Node
        • Crypto Daybook Americas
        • State of Crypto
        • Crypto Long & Short
        • Crypto for Advisors
      • Webinars & Events
        Back to menu
        Webinars & Events
        • Consensus 2025
        • Policy & Regulation Conference
      Select Language
      English enEspañol esFilipino filFrançais frItaliano itPortuguês pt-brРусский ruУкраїнська uk