Most TechTransThai Security Research posts are CTF writeups. This one covers a real-world incident instead: malware that compromised my own PC, and whose stolen sessions were used to spread the MrBeast crypto scam from my accounts. Below is the analysis, plus detection rules and indicators for anyone who wants to check their own systems. Submitted by blueskychan_. The personal side of the story (in English and Thai) is on my blog. Summary On October 19, 2026, my Discord and Instagram accounts started spamming the MrBeast crypto casino scam (“MrBeast is giving away $2,500–$3,700, sign up and use promo code …”) to friends, DMs and Instagram Stories. The cause was not a cracked .exe, and not a fake CAPTCHA asking you to paste a command into Win+R. It was a VS Code extension for an AI coding tool called Geaix, which I installed from a .vsix file eight days earlier, on October 11. The extension works as a real AI coding assistant (it is a fork of the open-source Kilo Code). Hidden at the end of its code is a dropper that side-loads a fake jli.dll into a signed Java launcher, which decrypts an infostealer straight into memory. The stealer takes browser passwords and cookies (including Chrome’s newer v20 encryption), Discord tokens, Steam and Roblox sessions, autofill data, a screenshot and system info. It then keeps running to replace cryptocurrency addresses on the clipboard. Geaix is not a one-off. The same server hosts at least seven more “AI coding” sites that are the same web application under different names, with the same payload API. The MrBeast spam bots log in with those stolen sessions, which requires neither the password nor 2FA. YARA and Sigma rules, plus IOCs, are at the end of this post. Note: this is not how every MrBeast scam or session stealer works. There are many different stealers, spread through many kinds of files and apps, on every kind of machine. They mostly end the same way: stolen sessions, then spam. This post covers the one case I investigated first-hand, because it turned out to be an interesting one to take apart and document. ...
