Lightlife RAT Crypto Wallet Browser Extension Theft via PowerShell

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•7

Detects activity associated with the Lightlife RAT, which involves PowerShell scripts accessing cryptocurrency wallet browser extension directories, staging data using archive utilities, and exfiltrating collected data to external destinations like the Telegram Bot API.