Executive Summary
Needle is an active Malware-as-a-Service (MaaS) crypto-stealing platform distributed via the Phorpiex spam botnet. It employs a two-pronged attack strategy: a browser extension spoofer targeting wallets like MetaMask and Phantom, and a desktop-based Rust agent that impersonates legitimate applications such as Exodus, Trezor, and Ledger. Since April 2026, a single deployment has successfully enumerated nearly 2,000 victims and is actively moving stolen funds (primarily ETH and USDT) to cold storage.
The campaign's technical infrastructure is characterized by severe security lapses, including the embedding of unprotected C2 API keys within the malware binaries. This oversight allows for full enumeration of victim data and operator configurations. The platform's modular nature suggests multiple independent threat actors are likely renting the Needle infrastructure to conduct simultaneous campaigns across various delivery vectors, including malicious trading websites and DLL hijacking.