# Omnistealer: DPRK-Linked Blockchain-Based Infostealer Abusing TRON/Aptos/BSC as Resilient C2 to Loot Password Managers, Browser Credentials, Cloud Storage, and 60+ Crypto Wallets

> Omnistealer is an actively distributed, multi-stage infostealer tied to suspected DPRK-aligned operators who approach software developers with fake LinkedIn/Upwork job offers that drop malicious GitHub projects. The payload chain hides configuration and stage-routing data inside public transactions on TRON, Aptos, and Binance Smart Chain, then harvests credentials from 10+ password managers, 60+ browser crypto wallets, 9+ browsers, and major cloud-storage clients. Approximately 300,000 credentials have been collected across government, defense, financial, food-delivery, and adult-industry victims.

- **Published:** 2026-04-14T12:00:00Z
- **Last reviewed:** 2026-04-14T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0360
- **ID:** TL-2026-0360
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Omnistealer (also tracked as the Cross-Chain TxDataHiding campaign) is a cross-platform JavaScript/Python infostealer and modular RAT first publicly documented by Malwarebytes Labs, Ransom-ISAC, and Dataconomy in late March and April 2026. The operation is being run through a fake-recruiter pipeline aimed primarily at freelance and full-stack developers: attackers pose as hiring managers on LinkedIn and Upwork, move candidates to Telegram or Discord, then send them a ''coding test'' hosted in a private GitHub repository. The trojanized project (most often a Tailwind/Next.js frontend such as github.com/isasmallbit/store-v) embeds a hostile Tailwind.config.js or next.config.mjs that runs on install.

The dropper is deliberately engineered for takedown resistance. Stage 1 is a heavily obfuscated JavaScript stager that pulls a cross-chain lookup list from attacker-controlled TRON addresses (TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP, TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG, TLmj13VL4p6NQ7jpxz8d9uYY6FUKCYatSe), with fallback indices on Aptos (0xbe03..0811e, 0x3f0e..5dce3, 0x3414..05837). The index data points at specific Binance Smart Chain transaction hashes (0xf46c..19fc, 0xd33f..58fef, 0xa8cd..16ff) whose input fields carry the XOR-encrypted next-stage payload. Because the loader reads data directly from public RPC endpoints (api.trongrid.io, fullnode.mainnet.aptoslabs.com, bsc-dataseed.binance.org), defenders cannot seize or sinkhole the configuration channel — transactions are immutable and geographically unreachable by traditional takedown.

Stage 2 decrypts a cross-platform Python RAT (Payload1_1_1) and a Python dropper (Payload1_2_1) that fetches the final Omnistealer payload (Payload1_2_1_1). The RAT pivots to one of four hardcoded MongoDB-port (27017) C2 servers — 23.27.20.143, 136.0.9.8, 23.27.202.27, and 166.88.4.2 — using a _V routing byte to decide which operator node receives a given victim. HTTP endpoints /$/boot, /$/z1, /u/f, /u/e, /snv, and /verify-human/{version} handle delivery, file exfiltration, metadata, and environment-variable theft. A Telegram bot (token 7870147428:AAGbYG_eYkiAziCKRmkiQF-GnsGTic_3TTU) is hard-wired as a backup exfiltration channel whenever outbound HTTP to the primary C2 is blocked.

Omnistealer''s credential-collection surface is unusually broad. Targeted password managers include 1Password (aeblfdkhhhdcdjpifhhbdiojplfjncoa), LastPass (hdokiejnpimakedhajhdlcegeplioahd), Dashlane (fdjamakpfbbddfjaooikfcpapjohcfmg), NordPass (eiaeiblijfjekdanodkjadfinkhbfgcd), and Bitwarden (nngceckbapebfimnlniiiahkandclblb). Targeted wallet extensions include MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom (bfnaelmomeimhlpmgjnjophhpkkoljpa), Trust (egjidjbpglichdcondbcbdnbeeppgdph), Coinbase (hnfanknocfeofbddgcijnmhnfnkdnaad), TronLink (ibnejdfjmmkpcnlpebklmnkoeoihofec), Xverse (idnnbdplmphpflfnlkomgpfbpcgelopg), Keplr (dmkamcknogkgcdfhhbddcghachkejeap), and Rabby (acmacodkjbdgmoleebolmdjonilkdbch), plus desktop wallets (Exodus, Atomic, Electrum, Bitcoin Core, Monero, Solana CLI). Chrome, Edge, Brave, Firefox, Opera, Opera GX, Vivaldi, Arc, and Chromium are all scraped for saved logins and cookies. The stealer also enumerates Dropbox, Google Drive, OneDrive, iCloud, Box, Mega, and pCloud client state.

Persistence is established through targeted JavaScript injection into VSCode and Cursor IDE installations — specifically the @vscode/deviceid module — marked with a /*C250617A*/ comment header to prevent re-injection. The Cursor injection is particularly notable because AI-assisted coding IDEs execute user code in a higher-trust context, effectively backdooring the developer''s entire toolchain. Evasion logic blocks execution in AWS EC2, Azure, GCP, Vercel, Amplify, GitHub Actions runners, Docker containers, Kali Linux, and the test hostname EV-CHQG3L42MMQ. A catastrophic-backtracking regex (.search("(((.+)+)+)+$")) is used as an anti-debugger tripwire.

Exfiltrated data is packaged into password-protected ZIP archives named {hostname}${username}_{timestamp}*#{MD5}.zip* with the hardcoded password ,./,./,./ and pushed to /u/f. Ransom-ISAC attributes the campaign with medium confidence to DPRK-aligned actors based on overlaps with the DeceptiveDevelopment, DEV#POPPER, and Operation DreamJob (Lazarus) clusters, consistent with Pyongyang''s documented focus on cryptocurrency theft for sanctions evasion. The Malwarebytes public disclosure on 2026-04-14 made Omnistealer a top-priority monitoring item for every SOC with developer endpoints.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1586 Compromise Accounts
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1132 Data Encoding
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Omnistealer uses the blockchain to steal everything it can](https://www.malwarebytes.com/blog/news/2026/04/omnistealer-uses-the-blockchain-to-steal-everything-it-can)
- [Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 2)](https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist-part-2/)
- [Omnistealer Malware Campaign Targets Developers Through GitHub](https://dataconomy.com/2026/03/31/omnistealer-malware-campaign-targets-developers-through-github/)
- [Hackers are using fake coding jobs to spread malware through GitHub](https://www.techspot.com/news/111870-hackers-using-fake-coding-jobs-spread-malware-through.html)
- [Malware Hidden in Blockchain Networks Is Quietly Targeting Developers Worldwide](https://www.cysecurity.news/2026/04/malware-hidden-in-blockchain-networks.html)
- [Ransom-ISAC LOCKSTAR XCTDH Crypto Heist IOC/Detection Repo](https://github.com/Ransom-ISAC-Org/LOCKSTAR/tree/main/XCTDH_Crypto_Heist)
- [UNC5142 Leverages EtherHiding to Distribute Malware (context on blockchain C2)](https://cloud.google.com/blog/topics/threat-intelligence/unc5142-etherhiding-distribute-malware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0360