Tusk Infostealer Drains Wallets via Cloned DAO Platform

In February 2025, a blockchain development firm discovered an employee redirected to a fake website. The site, tidyme.io, cloned the legitimate DAO management platform peerme.io. Seconds later, multiple cryptocurrency wallets linked to the organization were drained.

Security researchers at Kaspersky traced the attack to StealC, a modular information stealer designed to harvest browser data, passwords, and private keys. The malware reached victims through a malicious Electron application disguised as a platform update. The attackers stored the payloads on Dropbox, using it as the delivery infrastructure for both Windows and macOS machines.

The malware included a config.json file with Base64-encoded URLs pointing to additional stages. A JavaScript function inside preload.js handled downloading the archive and preparing it for execution. Kaspersky noted that internal log messages referred to victims as "Mammoths."

The third sub-campaign impersonated an AI translator project, luring users with a promise of legitimate features. This shift exploits the growing trust in AI tools, a pattern researchers said is increasingly common.