Web3 Game Developers Targeted in Crypto Theft Scheme

Recorded Future's Insikt Group reports a Russian-language trap-phishing campaign that impersonates legitimate Web3 gaming projects and lures developers to download malicious installers that deploy infostealers (Atomic macOS Stealer, Rhadamanthys, RisePro) on macOS and Windows, with the primary objective of stealing cryptocurrency wallets and credentials. The actor uses cloned social-media accounts, fake job/NFT lures, and resilient infrastructure sharing C2 servers across multiple fake projects; victims have reported wallet drains. The report includes IOCs and mitigation guidance such as user training, verifying sources before installing software, multi-platform endpoint protections, and EDR/antivirus updates.