: Private keys and login details for cryptocurrency extensions and desktop wallets [1, 4].

: Links under videos promising "cracked" software, game cheats, or free premium tools [3].

While it may appear to be a legitimate software package or media file on certain platforms, it is frequently used as a delivery mechanism for information-stealing software [3, 4].

: Once executed, the software attempts to exfiltrate: