Do Son OysterLoader malware uses custom LZMA & steganography to evade tools. Linked to Rhysida ransomware, it hides in fake IT installers.
C# malware
G DATA exposed Arkanix, a fast-evolving C++ stealer. Its premium version uses process injection and Chrome Elevator to bypass Chrome App-Bound Encryption (ABE) and steal crypto wallets and Wi-Fi passwords.
Vidar 2.0, fully rewritten in C, is a multithreaded infostealer that bypasses Chrome's AppBound encryption via memory injection to steal crypto wallets and credentials. Its adoption spikes as Lumma declines.
FortiGuard uncovered Chaos-C++, a dangerous new ransomware strain. It deletes file content over 1.3 GB and uses clipboard hijacking to steal Bitcoin during payments.
Gremlin Stealer malware, written in C#, exfiltrates browser data, crypto wallets, and VPN credentials, distributing stolen data via a Telegram-based backend.