EtherRAT Variant Links Web2 Malware To Web3 Crypto Theft

The report describes the convergence of credential-stealing malware and cryptocurrency drainers, highlighting StepDrainer — a multichain drainer using polished social engineering and dynamic script injection to steal funds across 20+ blockchains — and a Windows variant of EtherRAT distributed via a trojanized Tftpd64 installer that bundles a Node.js runtime, achieves registry persistence, and performs reconnaissance to facilitate theft and evasion.