Needle Malware Targets Desktop and Hardware Wallets

Capabilities and Behavior

Needle operates as a comprehensive financial interception and data extraction toolkit. The malware family incorporates system profiling routines, clipboard interception, automated filesystem discovery for sensitive credentials, and automated token extraction. Its core capabilities center on deceptive interface generation designed to trick experienced cryptocurrency holders.

Deceptive Interface Manipulation

The primary vector for compromising cold storage devices is the Desktop Wallet Spoofer module. Developed using modern graphical frameworks such as Rust egui, this component continuously polls running processes on the host. When it identifies executable names associated with bridge software such as Ledger Live, Trezor Suite, Exodus, or Atomic Wallet, it suppresses the legitimate interface or renders a persistent modal window directly over the running application.

This spoofed window displays an authentic-looking system message prompting the operator to complete a mandatory device resynchronization or wallet restoration. Victims are prompted to input their 12-to-24-word recovery seed phrase using their physical keyboard. To maintain operational secrecy, the malware features an evasion configuration parameter that launches the genuine wallet application as soon as a valid mnemonic seed is captured, ensuring the operator notices no operational friction.

Multi-Asset Balance Sweeping and HVNC Integration

Needle includes automated funds drainer logic capable of interacting directly with public blockchain RPC endpoints and indexing APIs such as TronGrid. When private keys or seed phrases are captured, automated multi-chain scripts verify available balances across Bitcoin, Ethereum, Solana, TRON, Litecoin, and Dogecoin networks, initiating transfers to threat actor destination addresses within seconds.

For complex decentralized finance (DeFi) positions or staked assets requiring manual execution, the operator can deploy the bundled HVNC module. This hidden virtual desktop enables threat actors to execute transactions, interact with active web sessions, and manipulate local application data without projecting mouse movements or window changes onto the user physical monitor.

Infection Chain and Persistence

The delivery architecture for Needle relies on multi-stage social engineering campaigns and commodity malware distribution networks. Security researchers have traced active distribution campaigns to watering-hole infrastructure and typosquatted domains advertising automated trading utilities such as fake AI-driven TradingView tools.

Execution via Signed Binaries and Process Injection

The initial infection payload is commonly distributed within compressed archive files containing a legitimate, Microsoft-signed executable alongside a malicious dependency. The attack sequence unfolds across distinct execution stages:

• Initial Execution: The user executes a renamed Microsoft Windows SDK utility, such as OLEView renamed to Trading Agent.exe. Because the binary carries a valid Microsoft digital signature, initial execution often bypasses traditional reputation filters and endpoint defenses.

• DLL Side-Loading: Upon execution, the trusted binary resolves dependent dynamic link libraries from its current working directory, unknowingly loading a malicious library named iviewers.dll.

• Process Hollowing: The malicious DLL decrypts the embedded Needle payload and initiates process hollowing against a legitimate Windows framework binary, typically RegAsm.exe located in the standard .NET Framework directory.

Persistence Mechanisms and Extension Staging

Once executing within the hollowed process context, Needle establishes persistence by creating scheduled tasks and Registry run keys configured to launch the desktop spoofer whenever the system restarts. In parallel, the malware stages a persistent rogue browser extension into user profile directories, specifically targeting the local package path at %LOCALAPPDATA%\Packages\Extensions\.

This companion extension registers under deceptive names mimicking legitimate Google software services. The extension monitors web application interaction, captures keystrokes, and modifies Document Object Model (DOM) elements on popular Web3 browser extension interfaces, including MetaMask, Phantom, and Coinbase Wallet.

Command and Control

Needle relies on structured HTTP and HTTPS REST communications to interact with centralized management infrastructure. The administrative control panel, built with modern web frameworks, exposes distinct API endpoints designed to separate administrative oversight from high-volume automated data exfiltration.

Observed network communications demonstrate modular routing patterns across dedicated command nodes:

• Configuration Retrieval: The payload queries endpoints such as /backup-domains/active to receive dynamic failover domains if primary command infrastructure is blocked.

• Harvested Credential Ingestion: Exfiltration payloads containing compressed browser tokens, Telegram Desktop sessions, and extracted credentials are submitted via HTTP POST requests to the /upload endpoint.

• Web Injection Scripts: The rogue browser extension connects to /scripts and /extension to download updated JavaScript rules, redirection URLs, and overlay templates targeting newly released wallet interfaces.

• Drainer Configurations: Dedicated paths such as /api/v2/antiledger/settings deliver fresh receiver blockchain addresses and third-party RPC credentials used by the fund-sweeping engine.

Continuous monitoring of internet-facing infrastructure is essential to intercept adversary command nodes and identify compromised accounts before lateral movement takes place. Proactively cataloging organizational entry points through Attack Surface Management enables defenders to block unauthorized outbound access routes.

Detection Logic and Indicators

Detecting Needle requires behavioral analysis focusing on process lineage anomalies, unauthorized extension installations, and abnormal parent-child relationships involving standard Windows administrative binaries.

Detection Rules and Hunting Strategies

Security operations centers should deploy behavioral detection rules targeting DLL search-order hijacking and process hollowing. Key detection criteria include:

• Unusual Process Creation: Monitor for instances of RegAsm.exe spawned without standard command-line parameters or parented by unexpected binaries located in user-writable directories such as %APPDATA% or %TEMP%.

• Suspicious Library Loading: Alert on any load event for iviewers.dll occurring outside standard Microsoft Visual Studio or Windows SDK installation directories.

• Unpacked Extension Staging: Inspect endpoint file creation events for script files (popup.js, content.js, background.js) created directly within %LOCALAPPDATA%\Packages\Extensions\.

• Network Lineage Discrepancies: Monitor outbound external network connections originating from RegAsm.exe, which rarely requires direct external communication to unclassified public IP addresses.

Indicators of Compromise (IoCs)

Defenders should evaluate the following file hashes and network indicators across endpoint telemetry and perimeter controls:

• File Hashes (SHA-256): 95dcac62fc15e99d112d812f7687292e34de0e8e0a39e4f12082f726fa1b50ed (Needle Payload)

• File Hashes (SHA-256): 0d10a6472facabf7d7a8cfd2492fc990b890754c3d90888ef9fe5b2d2cca41c0 (Loader Component)

• File Hashes (SHA-256): 3cc179a88902d76972d4bf4f98c0edf8138e81acabe711517dcdd31c14f73cc6 (Installer Bundle)

• Malicious Domains: tradingclaw.pro, chrocustumapp.com, chrocustomreversal.com, coretest.digital, reisen.work, google-services.cc

• C2 IPv4 Addresses: 178.16.55.234, 185.11.61.149, 37.221.66.27, 2.56.179.16, 209.17.118.17

Removal and Recovery

Remediating a confirmed Needle infection requires decisive actions across both host systems and distributed cryptographic accounts. Because Needle prioritizes financial extraction, incident responders must treat all cryptographic assets associated with the host as actively compromised.

Containment and Endpoint Sanitation

Security teams responding to Needle detections must immediately execute the following procedures:

• Host Isolation: Immediately disconnect the affected workstation from local network segments and wireless interfaces to disrupt active HVNC connections and halt automated exfiltration routines.

• Process Termination: Terminate suspicious instances of RegAsm.exe running from user directories and unregister associated scheduled tasks or startup keys.

• Directory Removal: Purge rogue extension directories located under %LOCALAPPDATA%\Packages\Extensions\ and inspect web browser preferences to remove untrusted developer-mode extensions.

• Telemetry Blocking: Apply perimeter DNS sinkholes and IP blocks across internal gateways for all identified Needle command servers.

Cryptographic Asset Protection and Recovery

Endpoint cleanup alone is insufficient to protect organization-managed digital assets once seed phrases have been entered into spoofed forms:

• Do Not Use Compromised Endpoints: Never attempt asset recovery or transaction signing from an infected device. Conduct all recovery tasks from an isolated, verifiably clean system.

• Emergency Asset Migration: Generate new cryptographic addresses on a freshly initialized hardware wallet configured with an entirely new seed phrase. Transfer all remaining balances immediately to the new addresses.

• Mnemonic Seed Invalidation: A hardware wallet private key is permanently invalidated once its 12-to-24-word recovery phrase has been typed into an endpoint keyboard. The compromised mnemonic must never be reused.

• Session and Credential Revocation: Invalidate all active browser cookies, rotate enterprise credentials, and use Telegram Desktop account settings on a secure device to terminate all active sessions.