Researchers have identified a new variant of “BlackGuard”, an information-stealing malware first discovered in March 2022 being sold as malware-as-a-service (MaaS) in Russian-speaking forums. BlackGuard is known for its attempts at exfiltrating “cookies and credentials stored in web browsers, cryptocurrency wallet browser extension data, desktop crypto wallet data, information from messaging and gaming apps., email clients, and FTP or VPN tools.” The active malware is constantly evolving, and the new variant has updated, advanced features. The malware now has the ability to propagate through removable devices, such as USBs, and automatically infect new machines. The BlackGuard variant can also establish persistence between system reboots by adding itself under the “Run” registry key as well as copying malware files with random names to every folder within the C: drive. Researchers explained that this capability may be to increase the difficulty of removing the malware, but also noted that it could just be for annoyance. The malware can also download additional payloads from the command-and-control (C2) server and “execute them directly in the breached computer’s memory using the ‘process hallowing’ method” in order to bypass antivirus detection. Another new feature is a crypto wallet clipper module that replaces crypto addresses copied to the Windows clipboard with the operator’s address. Additionally, BlackGuard has broadened its target scope to include fifty-seven (57) crypto browser extensions and wallets to attempt to exfiltrate the data and crypto assets. Additional technical details and indicators of compromise (IOCs) can be viewed in the report linked below.