ACAS Tools / CyberShade / Answers
How can I tell if malware is stealing my passwords, sessions or crypto wallet?
Answered by ACAS Tools · Updated October 25, 2026
Infostealer malware copies your browser cookies, saved logins, SSH and cloud keys and crypto wallet files in seconds, usually without any visible sign. CyberShade, a Windows and Mac app, watches those exact files, names the program behind each read, plants decoy credentials that no real app touches, and lets you stop or quarantine the program.
It isn't an antivirus and won't catch every threat; keep yours. It makes a thief's first move visible and gives you a way to act. $29 launch price until November 15, 2026, with a 7-day full trial.
CyberShade: $29 launch price until Sunday, November 15, 2026 $49
7-day full trial · One-time purchase · Local-first
How
What to watch, and what CyberShade does
Know the targets: browser sessions and saved passwords, Discord and Telegram sessions, SSH keys, AWS and GitHub tokens, .env files, and wallets like MetaMask, Phantom and Exodus.
Watch for reads, not just downloads. A stolen session skips your two-factor prompt because the server thinks it's still you.
Use bait. CyberShade plants four decoy credentials, random per computer. Nothing legitimate reads them, so a read is a strong warning sign.
Guard the clipboard. Clipper malware swaps a crypto address you copied for the attacker's; CyberShade warns you before you send.
Act on the alert: stop the process, quarantine the app (reversible), or ignore it.
Honest limits
What to know first
Not an antivirus
CyberShade doesn't scan files for known malware. Keep your antivirus running alongside it.
Metadata only
It records which app touched a credential store, which file and when. Never the contents, and nothing leaves your computer.
After the trial
Watching and warning keep working. Stopping programs, quarantine, auto-stop, the Server role and remote alerts need a license.
FAQ
Common questions
What is an infostealer?
Malware, often installed through a fake download or a poisoned code repository, that copies saved logins, session cookies, keys and wallet files and sends them to an attacker.
Does two-factor authentication stop session theft?
No. A stolen session cookie is already logged in, so the server never asks for your second factor.
Does CyberShade watch AI coding tools?
Yes. It watches Claude Code keys, MCP configs, Cursor rules and agent instruction files, and flags a "rug pull" where a tool description or rule is quietly rewritten to leak secrets.
Does CyberShade upload my data?
No. Detection runs entirely on your computer, and it records metadata only, never file contents.
How much does CyberShade cost?
$29 launch price until Sunday, November 15, 2026, then $49. One-time purchase, with a 7-day full trial.
CyberShade
See what reaches for your wallet.
Everything is on for 7 days. Watching and warning keep working after that.
Full CyberShade details · Questions: [email protected] · License terms