From Crypto Wallets to a 100M-User VPN: Inside an Active STX RAT Supply Chain Campaign

A sophisticated threat actor is actively targeting crypto traders and privacy-focused users by distributing trojanized installers—including for the 100M-user X-VPN—via a coordinated supply chain campaign that sideloads STX RAT for credential and data theft, adapting infrastructure even after public exposure.