Skip to main content
Category: Hacks → Malware, Fake Wallets & Device CompromiseHacksMalwareKeylogger/RATReading time: 10 minutes
Risk level: Critical
Target audience: Software users, traders

​
Meet Emeka

Emeka is a developer who wanted to use Adobe Creative Suite but didn’t want to pay the subscription. He searched for “Adobe Photoshop crack” and found a download link. He downloaded and installed what appeared to be a cracked version of Photoshop. It functioned normally for a few days. But it was actually a RAT (Remote Access Trojan).

​
What Happened

​
Step 1: The RAT Installation

The “cracked Photoshop” included a hidden RAT program. RATs are malware that give attackers remote control of the infected computer. Once installed, the RAT:
  • Logs all keyboard inputs (keylogger function).
  • Captures screen screenshots.
  • Records webcam feed.
  • Accesses files and passwords.
  • Can run arbitrary commands.

​
Step 2: The Credential Theft

The RAT captured Emeka’s MetaMask password as he typed it while accessing his wallet. It also recorded screenshots of him entering his 2FA code, and captured his email password.

​
Step 3: The Compromise

The attacker, using the stolen credentials, logged into Emeka’s email and changed the password, locking him out. Then they:
  1. Accessed his MetaMask account (password known).
  2. Checked his blockchain holdings.
  3. Initiated a withdrawal to another wallet.
Emeka’s wallet contained ₦2.2 million in various tokens. Within 30 minutes, the attacker had drained it. By the time Emeka realized something was wrong, the tokens were moving through a mixer.

​
Where the Scammer Won

  1. Pirated software: The trojan was hidden in cracked software.
  2. System access: A RAT gives full remote control.
  3. Credential capture: All passwords and 2FA codes were logged.
  4. No alerting: The RAT ran silently; Emeka had no idea he was compromised.

​
Prevention

Never download cracked software. It’s the #1 vector for RATs and keyloggers.
Use legitimate, paid software or open-source alternatives.
Run antivirus/antimalware regularly and keep it updated.
Use a password manager so you don’t type passwords (harder for keyloggers to capture).
Enable 2FA with TOTP (authenticator app) instead of SMS or email codes (reduces one vector of compromise).
Keep your operating system and applications updated. Updates patch security vulnerabilities.

​
How RATs and Keyloggers Work

What happens: Malware is hidden in cracked software, fake downloads, or malicious email attachments.
What happens: RAT installs silently in background, often disguised as legitimate system process.
What happens: RAT logs all keyboard input, capturing passwords, seed phrases, and other sensitive data.
What happens: RAT takes screenshots of sensitive information (2FA codes, wallet balances, etc.).
What happens: Attacker gains full remote control of infected system, can access files and execute commands.
What happens: Attacker uses captured credentials to access accounts and drain funds.

​
If You Suspect a RAT Infection

1

Disconnect from Internet Immediately

Disconnect from the internet immediately to prevent further data exfiltration.
2

Change All Critical Passwords

Change all critical passwords from a different, clean device.
3

Assume All Data is Compromised

Assume all data on the computer is compromised (passwords, keys, documents).
4

Move Crypto to New Wallets

Move all crypto to new wallets with new seed phrases (from a clean device).
5

Run Full Malware Scan

Run a full malware scan or wipe the computer completely.
6

Report Stolen Funds

Report stolen funds to law enforcement and ChainAbuse.

Clipboard Hijacker

How clipboard malware steals wallet addresses

Hacks Category

Explore all types of malware and device compromise

Check Your Wallet

Verify if addresses are reported as malicious

​
References

  1. RAT and keylogger malware detection
  2. Antivirus and antimalware recommendations
  3. Password manager security benefits