# Infostealer · Drain Watch

10 incidents, 2 live. JSON: https://drains.watch/t/infostealer.json · RSS: https://drains.watch/t/infostealer/feed.xml

- [Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets](https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026) (live, Critical, Still active, since Sep 18, 2026)
- [Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys](https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026) (closed, Critical, Partly contained, since Jun 8, 2026)
- [TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools](https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026) (closed, High, Partly contained, since May 26, 2026)
- [notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies](https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026) (closed, High, Still active, since Apr 10, 2026)
- [Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers](https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026) (closed, Critical, Contained, since Mar 24, 2026)
- [Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down](https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026) (closed, Low, Contained, since Feb 24, 2026)
- [Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys](https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026) (live, High, Partly contained, since Feb 5, 2026)
- [Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files](https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025) (closed, Critical, Contained, since Aug 26, 2025)
- [Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer](https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025) (closed, High, Partly contained, since Jul 10, 2025)
- [North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac](https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025) (closed, Medium, Still active, since Jun 11, 2025)