Recent cybersecurity updates reveal significant malware threats and arrests in human trafficking cases linked to crypto scams.
Recent cybersecurity developments have unveiled significant threats and actions taken against cybercriminals globally.
- Over 700 browser-based crypto wallets are at risk from Torg Grabber, an info stealer.
- The UK has sanctioned the cryptocurrency platform Xinbi and scam operations in Southeast Asia.
- A cyberattack on Intoxalock has disrupted ignition interlock systems for vehicles.
- Malware exploiting Solana has been linked to cryptocurrency theft and phishing.
Torg Grabber Targets Crypto Wallets
The Torg Grabber malware has emerged as a significant threat, targeting around 850 browser extensions, particularly focusing on 728 crypto wallets, including MetaMask and TrustWallet. Cybersecurity researchers from Gen Digital reported that the malware gains access through a clipboard manipulation technique, tricking users into executing malicious commands.
In addition to stealing sensitive data from various applications, Torg Grabber can create digital fingerprints, analyze software installations, take screenshots, and execute arbitrary code on infected devices. Since late 2025, it has utilized effective HTTPS connections to bypass security measures in popular browsers.
UK Sanctions Xinbi and Scam Camps
On March 26, the UK government imposed sanctions on Xinbi, a cryptocurrency marketplace alleged to facilitate the sale of stolen data and aid in human trafficking operations in Southeast Asia. The sanctions are part of a broader effort to disrupt networks involved in human trafficking, particularly targeting the scam camp #8Park in Cambodia, where thousands are reportedly held in forced labor.
According to Chainalysis, Xinbi processed over $19.9 billion in transactions between 2021 and 2025, highlighting the scale of its operations.
Cyberattack on Intoxalock Affects Vehicle Access
Intoxalock, a provider of ignition interlock systems, experienced a cyberattack that disabled device functionalities, preventing some users from starting their vehicles. The attack impacted a significant percentage of users, particularly in Connecticut, where 7-10% faced issues due to expired calibration checks. The company has since extended authorization periods and promised reimbursement for affected users.
Solana Exploited in Malware Campaign
Researchers at Aikido have identified a new phase of the GlassWorm campaign, where hackers are using Solana's blockchain to mask their command server's location. The malware, distributed through various platforms including npm and GitHub, is capable of stealing developer data and installing remote access trojans. The attack methodology involves extracting hidden links from transaction notes on the Solana blockchain, allowing hackers to retrieve sensitive information without direct exposure.
The GlassWorm campaign also includes phishing attempts targeting users of hardware wallets, employing deceptive messages to capture recovery phrases. The malware's capabilities extend to monitoring user activity across crypto exchanges, raising significant concerns about the security of digital assets.
LiteLLM App Compromised by Trojan
A credential-stealing malware has been discovered in the AI app LiteLLM, which allows developers to connect to various neural networks. The malware infiltrated systems through a third-party package, leading to widespread credential theft. Despite the rapid response from LiteLLM's developers to address the threat, concerns about the app's security certifications have been raised, especially regarding its previous audits by Delve.
"Oh damn, I thought this WAS a joke... but no, LiteLLM really was 'Secured by Delve'... and unsurprisingly, LiteLLM was compromised, badly" — Gergely Orosz.
LiteLLM has begun an investigation with Mandiant to further understand and mitigate the breach.
