StealC Cryptocurrency Wallet Directory Access by Non-Wallet Process

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects read access to cryptocurrency wallet files and application directories (including Electrum, Exodus, Atomic, and generic wallet.dat files) by non-wallet associated processes. This behavior is consistent with credential harvesting activities by info-stealing malware such as StealC.