New Information Stealer Targeting Crypto Wallets: Key Threats

Doenerium Stealer: Cyble CRIL observed a spear-phishing campaign that lures Office365 users to a malicious domain hosting a trojanized “Microsoft Windows Malicious Software Removal Tool” executable (masquerading as Node.exe). The malware implements sandbox/VM checks, kills analysis/virtualization tools, establishes persistence, harvests browser data, Discord tokens and crypto wallet addresses (including clipboard clipping), compresses collected artifacts and exfiltrates via a Discord webhook; the report includes technical analysis and IOCs (hashes, URLs, domains).