Gamers at Risk: Fake Roblox Mods Spread Crypto-Stealing Malware

Cybersecurity researchers at Kaspersky have discovered Stealka, a sophisticated infostealer disguised as game mods and pirated software. This malware targets cryptocurrency wallets and browser credentials using over 115 different extensions.

Key Takeaways

Stealka Malware: This infostealer masquerades as game mods to target cryptocurrency wallets and browser data.
Widespread Distribution: It spreads through trusted sites, using attractive false promises of game cheats.
Broad Threat: Stealka targets over 100 applications, including major web browsers and crypto wallets.
Security Crisis in Crypto: The malware incident highlights growing security vulnerabilities in the cryptocurrency industry.
Recommendations: Users are urged to deploy antivirus tools, avoid storing credentials in browsers, and exercise caution with downloads.

Gamers at Risk as Fake Roblox Mods Spread Crypto-Stealing Malware

Stealka is disseminated through reputable platforms such as GitHub, SourceForge, and Softpedia. Attackers craft professional-looking fake websites and repositories that distribute the malware disguised as popular game cheats for titles like Roblox and GTA V.

Understanding Stealka’s Expansive Threat

The Stealka malware poses a significant threat, functioning beyond mere credential theft. It specifically targets data from browsers that use Chromium and Gecko engines, putting a wide array of applications—like Chrome, Firefox, Opera, and Edge—at risk.

The malware gathers autofill data, session tokens, and cookies, which allow cybercriminals to evade two-factor authentication and seize accounts without needing passwords. It particularly aims at 115 browser extensions associated with crypto wallets, password managers, and authentication services.

Notable targets include popular crypto wallets like Binance, Coinbase, MetaMask, Trust Wallet, and Phantom, as well as widely used password managers like 1Password, Bitwarden, LastPass, and NordPass.

The malware can download configuration files from 80 wallet applications associated with cryptocurrencies such as Bitcoin, Ethereum, Exodus, Monero, and Dogecoin. These files may contain encrypted private keys and seed phrases that can lead to compromised holdings.

In addition to cryptocurrency theft, Stealka can infiltrate messaging apps like Discord and Telegram, email clients like Outlook and Thunderbird, and gaming platforms such as Steam and Roblox. It also targets VPN clients and note-taking applications that users may improperly utilize to store sensitive information.

Moreover, the malware collects system data, creates lists of installed programs, identifies hardware specifications, and even captures screenshots to broaden its information-gathering abilities.

Attackers have utilized compromised accounts to further propagate the malware, with Kaspersky identifying it in a GTA V mod uploaded by an already hijacked account on a modding site.

Growing Security Challenges in the Industry

The emergence of the Stealka campaign intensifies existing security crises within the cryptocurrency sector, which has suffered losses of $9.1 billion in 2025 alone, accounting for about 10% of the $90 billion stolen over the last 15 years. In November alone, losses exceeded $276 million, setting alarming records.

“Crypto is facing a security reckoning,” remarked Mitchell Amador, CEO of Immunefi, a crowdsourced security platform overseeing $180 billion in assets. He noted that most hacks this year have occurred not due to inadequate audits but during protocol upgrades and integrations.

Amador pointed out that 99% of Web3 projects lack fundamental firewalls, and less than 10% use modern AI-driven security tools, labeling this negligence as “willful.”

The primary target has shifted away from code vulnerabilities towards operational security breaches, as the complexity of smart contracts makes them harder to exploit.

“The threat landscape is transitioning from on-chain code vulnerabilities to operational security and treasury-level attacks,” explained Amador. “As coding practices improve, the focus is now on exploiting human errors.”

Kaspersky's broader investigations reveal a persistent malware ecosystem, including campaigns like GitVenom, SparkKitty, and ClipBanker, and even North Korean threat groups leveraging blockchain technology to embed malware in smart contracts on networks like BNB Smart Chain and Ethereum.

To safeguard against such threats, Kaspersky recommends that users:

Use reliable antivirus software.
Avoid storing sensitive credentials within browsers.
Be extremely cautious with game cheats and pirated software.
Enable two-factor authentication and keep backup codes in secure, encrypted password managers instead of text files.
Steer clear of downloading software from unreliable sources, despite the convenience they may promise.