BlackGuard, which was first spotted in March 2022, has experienced an upgrade with several new capabilities. It added a crypto wallet hijacker module that has hardcoded addresses and support for multiple cryptocurrencies. The stealer can now propagate via USB and other removable devices to infect new hosts. Also, it can now steal data and drain crypto assets from 12 more cryptocurrency browser extensions and wallets.