Jinse Finance reported that Kaspersky discovered a new complex multi-stage attack targeting encrypted wallets in Europe, the United States, and Latin America. The attack involved DoubleFinger Loader, a sophisticated piece of crimeware that deploys the GreetingGhoul cryptocurrency stealer and the Remcos remote access Trojan (RAT) on the compromised computer. The multi-stage DoubleFinger loader launches an attack when a victim inadvertently opens a malicious PIF attachment in an email.