Cybersecurity researchers are flagging a fresh wave of malware tactics aimed at people who hold, build, and advise on crypto-related software. Kaspersky, for instance, says it has discovered a new malware framework—dubbed OkoBot —that targets cryptocurrency investors by combining social engineering with data theft capabilities. At the same time, SlowMist warns of a separate intrusion campaign that targets Web3 developers through seemingly legitimate recruitment messaging on LinkedIn, pushing victims to run poisoned code hosted on GitHub. Together, the incidents underscore how attackers are increasingly using everyday work routines—interviews, code trials, and app installs—as delivery mechanisms for malware. Key takeaways OkoBot is designed to steal crypto-related data by harvesting wallet files, browser information, credentials, and injected browser or extension activity. Kaspersky says it has observed multiple OkoBot-linked attacks since January 2026 , and that the framework evol...

Two separate cybersecurity reports point to a growing trend in crypto-related malware: attackers are no longer relying only on obvious phishing emails. Instead, they are moving closer to the workflows people already use—recruiting pipelines, developer code trials, and wallet-related software behavior. Kaspersky says it has uncovered a cryptocurrency-targeting malware framework dubbed “OkoBot,” which initiates an infection chain through social engineering, malicious commands, and trojanized GitHub applications. Separately, SlowMist describes a campaign aimed at Web3 developers that starts with fake LinkedIn recruitment offers and ends with poisoned repositories designed to deliver remote access. Key takeaways Kaspersky links the OkoBot framework to wallet theft activity, including harvesting wallet files and capturing browser and credential data. OkoBot is designed to steal assets by injecting malicious browser extensions and collecting wallet application windows, Kaspersky reports...

France’s gambling regulator has ordered internet service providers to block access to Polymarket, escalating a wave of restrictions aimed at prediction platforms operating outside local authorizations. In a Friday press release , the Autorité nationale des jeux (ANJ) said prediction websites fall under illegal gambling rules if they are not authorized, adding that advertising or promoting such sites is a criminal offense punishable by fines of up to 100,000 euros. Key takeaways France’s ANJ has ordered ISPs to block Polymarket, citing lack of authorization and illegal gambling promotion risks. The regulator argues Polymarket’s features resemble regulated gambling, but without “protective mechanisms” found in the legal market. ANJ also raised concerns about possible outcome manipulation, including allegations involving weather-related contracts. Polymarket has already been geoblocked in multiple regions, according to its own documentation. Regulatory scrutiny is not limited to...

France’s national gambling regulator has ordered internet service providers to block access to Polymarket, arguing that the platform operates like illegal gambling in the country. The Autorité nationale des jeux (ANJ) said Polymarket’s services are not authorized in France and warned that promoting unapproved gambling sites can trigger criminal penalties. The move underscores how prediction and “event contract” platforms continue to run into regulatory friction across Europe and beyond—particularly over whether these products should be treated as gambling, unlicensed financial instruments, or something else entirely. Key takeaways The ANJ directed French ISPs to block Polymarket, saying its prediction contracts amount to illegal gambling under French law. The regulator cited “addictive” mechanics and the absence of protective safeguards common in regulated gambling markets. ANJ also pointed to concerns that certain outcomes could be manipulated, including references to hacked wea...

The value of global semiconductor stocks plummeted after the release of the Kimi K3 AI model by Moonshot AI, driving the Philadelphia Semiconductor Index into bear territory. As per Coin Bureau on X , the index slumped by over 20% compared to the high in June, while the benchmark index of Taiwan fell by 6% and the Japanese market was down by 4%. The post also said chip stocks had wiped out around $3.3 trillion from their market value since June 22. Meanwhile, the graph posted alongside the article highlighted a sudden surge in the asset linked to the Kimi K3 release. Coin Bureau Reports Broad Semiconductor Selloff Market update for X was given by Coin Bureau after Moonshot AI announced the Kimi K3. In the update, the Philadelphia Semiconductor Index is said to be more than 20% lower than its record level in June, thus qualifying as a bear market. It was also reported that Taiwan's benchmark share index fell by more than 6%, while Japanese stocks declined by 4%. Coin Bureau went on ...

A macOS information-stealing malware can compromise cryptocurrency holdings by hijacking Telegram Desktop sessions and extracting wallet data, according to blockchain security firm SlowMist. The attack is notable because it focuses on taking over already-authenticated local sessions and stealing sensitive credentials, rather than relying solely on intercepting new logins. SlowMist says the malware harvests data from multiple sources on an affected Mac, including Apple’s Keychain, Safari cookies, Apple Notes, Telegram Desktop and wallet databases tied to more than a dozen crypto wallets. After collecting credentials and authenticated session material, attackers can use the stolen information to access wallets and potentially execute account takeovers. Key takeaways SlowMist reports a macOS malware chain that combines credential theft, browser/session harvesting, and wallet database extraction. Telegram two-step verification may not stop the attack because the malware reuses an exist...