Omnistealer uses the blockchain to steal everything it can

Omnistealer is an infostealer campaign that embeds encrypted commands and malware fragments in public blockchain transactions (TRON, Aptos, Binance Smart Chain) to create an undeletable, resilient staging and command‑and‑control channel. Once executed it harvests credentials from over 10 password managers, major browsers, cloud storage accounts, and more than 60 browser-based crypto wallets (including MetaMask and Coinbase Wallet); researchers estimate roughly 300,000 credentials have been compromised. Recommended mitigations include avoiding running untrusted code, using reputable password managers and MFA, isolating testing environments (VMs), and running up-to-date anti-malware.