Security researchers at Flashpoint and Sekoia is warning of Risepro, a malware used, among other things, to steal login information for a wide range of popular services and crypto wallets.

Risepro is primarily spread through pirate sites that offer tools to “crack” popular programs and games, reports Bleeping Computer.

Hackers who want to use Risepro can buy the code on Telegram or various forums on the darkside of the web.

Who is behind Risepro is unclear at the time of writing, but there are clear similarities to a similar malware called Privateloader.