Infostealer Archives • Daily CyberSecurity

Marsalek Malware Disguised as Game Cheats Uses Dual-Hook Setup to Steal Passwords and Wallets

Marsalek malware and dual-hook Marsalek malware attack chain diagram

Marsalek Malware Disguised as Game Cheats Uses Dual-Hook Setup to Steal Passwords and Wallets

Do Son November 9, 2026

McAfee Labs uncovers Marsalek malware in fake game cheats. See how the dual-hook Marsalek malware drops PureLog to steal passwords from gamers and hackers.

NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks NIK C2 framework and Windows NIK C2 framework attack architecture diagram

NIK C2 framework and Windows NIK C2 framework attack architecture diagram

NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks

Do Son November 2, 2026

Cisco Talos uncovers the NIK C2 framework. This Windows NIK C2 framework abuses OpenAI APIs to analyze stolen victim data and deploy screen lockers.

Fake Chocolatey and Massgrave Sites Deliver Python Armorsteal Malware via SEO Poisoning

Armorsteal malware and Python Armorsteal malware SEO poisoning infection chain diagram

Fake Chocolatey and Massgrave Sites Deliver Python Armorsteal Malware via SEO Poisoning

Do Son October 27, 2026

Zscaler uncovers an SEO poisoning campaign using fake Chocolatey and Massgrave sites to drop Armorsteal malware and Python Armorsteal malware modules.

Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents Malicious npm packages from the fake Web3 accelerator Apex delivering CloudSyncD and a Windows infostealer

Malicious npm packages from the fake Web3 accelerator Apex delivering CloudSyncD and a Windows infostealer

Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents

Do Son October 13, 2026

A fake Web3 accelerator used malicious npm packages to drop stealers on macOS and Windows and reroute AI coding agent traffic to its servers.

Trump Mobile Data Breach Exposes 3,615 Customers in BYOD Leak leak

Trump Mobile Data Breach Exposes 3,615 Customers in BYOD Leak

Do Son October 6, 2026

Trump Mobile data breach: BYOD leaks Trump Mobile customer data for 3,615 people, including Trump allies, via an infostealer and no MFA.

New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes 2CLoader malware infection chain delivering Vidar and Remus infostealers with anti-VM and evasion checks

2CLoader malware infection chain delivering Vidar and Remus infostealers with anti-VM and evasion checks

New 2CLoader Malware Delivers Vidar and Remus Infostealers While Dodging Sandboxes

Do Son October 5, 2026

2CLoader malware dodges sandboxes and security tools to deliver Vidar and Remus infostealers. See how it works and how to detect it.

New MacSync macOS Infostealer Targets Crypto Wallets Diagram of the new MacSync macOS infostealer showing how the MacSync macOS infostealer infects Apple devices

Diagram of the new MacSync macOS infostealer showing how the MacSync macOS infostealer infects Apple devices

New MacSync macOS Infostealer Targets Crypto Wallets

Do Son September 29, 2026

A new MacSync macOS infostealer spreads via fake apps. Learn how the MacSync macOS infostealer abuses iCloud to compromise Apple systems.

PamStealer macOS Malware Spreads via Fake Wavel Crypto App Diagram of the new PamStealer macOS infostealer showing how the PamStealer macOS infostealer infects Apple devices

Diagram of the new PamStealer macOS infostealer showing how the PamStealer macOS infostealer infects Apple devices

PamStealer macOS Malware Spreads via Fake Wavel Crypto App

Do Son September 28, 2026

A new PamStealer macOS infostealer spreads via fake Wavel apps. Learn how the PamStealer macOS infostealer steals system passwords and browser data.

MacSync macOS Stealer Spreads via ClickFix Lures MacSync macOS stealer architecture and MacSync macOS stealer ClickFix lures diagram

MacSync macOS Stealer Spreads via ClickFix Lures

Do Son September 11, 2026

The MacSync macOS stealer targets Apple users worldwide. See how MacSync macOS stealer ClickFix lures evade Gatekeeper to steal sensitive credentials.

Python NodeStealer Adds Keylogging and Screen Capture Spyware Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer Adds Keylogging and Screen Capture Spyware

Do Son September 8, 2026

Python NodeStealer now adds keylogging, clipboard, and screenshot spyware plus dual Telegram C2. See how the NodeStealer spyware upgrade works.

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites

Do Son August 27, 2026

WeedHack malware still targets Minecraft gamers through fake client sites and Minecraft SEO poisoning, McAfee Labs warns.

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns WordlistLoader malware delivering Amatera Stealer via a ClearFake fake CAPTCHA ClickFix prompt

WordlistLoader malware delivering Amatera Stealer via a ClearFake fake CAPTCHA ClickFix prompt

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns

Do Son August 24, 2026

WordlistLoader malware delivers Amatera Stealer through ClearFake fake-CAPTCHA campaigns, using stealthy evasion to steal browser data.

AmnesiaStealer macOS Infostealer Hacks Apple Devices

AmnesiaStealer macOS infostealer malware diagram detailing the new AmnesiaStealer macOS infostealer

AmnesiaStealer macOS Infostealer Hacks Apple Devices

Do Son August 19, 2026

Jamf Threat Labs has discovered a new AmnesiaStealer macOS infostealer malware. The AmnesiaStealer macOS infostealer steals data and hijacks browsers.

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate

Do Son August 12, 2026

A macOS ClickFix campaign now uses a browser fingerprinting gate to hide AMOS infostealer lures from researchers. See how it works.

Fake AI Tools Malware Targets Developers Through GitHub Fake AI tools malware in a GitHub infostealer campaign targeting developers

Fake AI Tools Malware Targets Developers Through GitHub

Do Son August 11, 2026

Fake AI tools malware targets developers in a GitHub infostealer campaign using SmartLoader and blockchain C2. See how it works.

Xeno Roblox Malware Spreads a Java Stealer Through Fake Cheats CVE-2024-3393 - Zservers sanctions

Xeno Roblox Malware Spreads a Java Stealer Through Fake Cheats

Do Son August 6, 2026

A fake Xeno cheat spreads Xeno Roblox malware, a Java stealer that grabs accounts and crypto wallets and spies via webcam. Learn how to stay safe.

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers

Do Son August 3, 2026

CastleLoader malware now delivers NeedleStealer, a Rust crypto wallet spoofer and Golang browser hijacker. Arctic Wolf tracks three new campaigns.

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads

Do Son July 27, 2026

Malwarebytes finds fake games spreading Amatera Stealer through RenPy Loader, MSBuild abuse, and EtherHiding C2. See the infection chain and defenses.

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors

Do Son July 27, 2026

Proofpoint details the Cruciferra crypter service that cloaks RATs and infostealers using BYOVD EDR tampering and 90+ custom encryption routines.

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests

Do Son July 24, 2026

Elastic found a Contagious Interview campaign using fake coding interviews and SVG steganography to steal developer credentials and crypto wallets.

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains

Do Son July 24, 2026

Microsoft warns of rising ACR Stealer attacks using ClickFix lures to steal browser credentials and tokens from enterprises. Two chains detailed.

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims Trojanized streaming site causing Packagist themes iOS spyware infections

Trojanized streaming site causing Packagist themes iOS spyware infections

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims

Do Son July 23, 2026

Varonis Threat Labs analyzed Dolphin X stealer, a forum-sold RAT with 300+ credential targets and an AI Profiler that ranks victims for operators.