Malware Campaign Targets Crypto Wallets With Fake PDF Conversion Software

A malware campaign is using fake PDF to DOCX converters as a vector for sneaking malicious PowerShell commands onto machines, enabling the attacker to access crypto wallets, hijack browser credentials and steal information.

Following an FBI alert last month, CloudSEK Security Research team has carried out an investigation revealing details about the attacks.

The goal is to trick users into executing a PowerShell command which installs the Arechclient2 malware, a variant of SectopRAT, an information stealing family known to harvest sensitive data from victims.

The malicious websites impersonate that of legitimate file converter PDFCandy, but instead of loading the real software, the malware is downloaded. The site features loading bars and even CAPTCHA verification in order to lull users into a false sense of security.

Ultimately, after several redirects, the victim’s machine downloads an “adobe.zip” file containing the payload—exposing the device to the Remote Access Trojan, which has been active since 2019.

This leaves users open to data theft, including browser credentials and cryptocurrency wallet information.

The malware “checks extension stores, lifts seed phrases, and even taps into Web3 APIs to ghost-drain assets post-approval,” Stephen Ajayi, Dapp Audit Technical Lead at blockchain security firm Hacken, told Decrypt.

CloudSEK advised people to use antivirus and antimalware software, and to “Verify file types beyond just extensions, as malicious files often masquerade as legitimate document types.”

The cybersecurity firm also advises that users rely on “trusted, reputable file conversion tools from official websites rather than searching for ‘free online file converters’,” and to consider using “offline conversion tools that don’t require uploading files to remote servers.”

Hacken’s Ajayi advised crypto users to remember that, “Trust is a spectrum, it’s earned, not given. In cybersecurity, assume nothing is safe by default.” He added that they should, “Apply a zero trust mindset, and keep your security stack up to date especially EDR and AV tools that can flag behavioral anomalies like rogue msbuild.exe activity.”

“Attackers evolve constantly and so should defenders,” Ajayi noted, adding that, “Regular training, situational awareness, and strong detection coverage are essential. Stay skeptical, prepare for worst-case scenarios, and always have a tested response playbook ready to go.”