Infostealer Archives • Daily CyberSecurity

Python NodeStealer Adds Keylogging and Screen Capture Spyware Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer Adds Keylogging and Screen Capture Spyware

Do Son September 8, 2026

Netskope Threat Labs found a major upgrade to the Python NodeStealer malware in August 2026. The Facebook-focused...

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack malware fake Minecraft client website using SEO poisoning to spread malicious downloads to gamers

WeedHack Malware Still Hits Minecraft Gamers via Fake Sites

Do Son August 27, 2026

At a Glance Malware family WeedHack (Malware-as-a-Service infostealer) Threat actor Unnamed MaaS operators and customers (not publicly...

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns WordlistLoader malware delivering Amatera Stealer via a ClearFake fake CAPTCHA ClickFix prompt

WordlistLoader malware delivering Amatera Stealer via a ClearFake fake CAPTCHA ClickFix prompt

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns

Do Son August 24, 2026

At a glance Malware family WordlistLoader (loader); Amatera Stealer / ACR Stealer (payload) Threat actor Amatera sold...

AmnesiaStealer macOS infostealer malware diagram detailing the new AmnesiaStealer macOS infostealer

AmnesiaStealer macOS Infostealer Hacks Apple Devices

Do Son August 19, 2026

Jamf Threat Labs researchers recently identified a fresh, multi-stage AmnesiaStealer macOS infostealer circulating online. Specifically, this malware...

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate

Do Son August 12, 2026

At a glance Malware family Atomic Stealer (AMOS) and MacSync infostealers Threat actor Unnamed operator running a...

Fake AI Tools Malware Targets Developers Through GitHub Fake AI tools malware in a GitHub infostealer campaign targeting developers

Fake AI Tools Malware Targets Developers Through GitHub

Do Son August 11, 2026

At a glance Malware family MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) Threat actor...

Xeno Roblox Malware Spreads a Java Stealer Through Fake Cheats CVE-2024-3393 - Zservers sanctions

Xeno Roblox Malware Spreads a Java Stealer Through Fake Cheats

Do Son August 6, 2026

At a glance Malware family Powercat (Java-based stealer and RAT) Threat actor Not attributed to a named...

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers

Do Son August 3, 2026

At a glance Malware family CastleLoader (loader); payloads include CastleStealer, NetSupport RAT, Lobshot, and NeedleStealer Threat actor...

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader infection chain in fake game installers using MSBuild and EtherHiding to deploy Amatera Stealer

RenPy Loader Spreads Amatera Stealer Through Fake Game Downloads

Do Son July 27, 2026

Attackers are hiding malware inside fake game and software installers. Malwarebytes Labs calls the threat RenPy Loader....

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Cruciferra Crypter Service Cloaks RATs and Infostealers for Many Threat Actors

Do Son July 27, 2026

A single crypter is now hiding malware for many unrelated criminal crews at once. Proofpoint researchers call...

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests

Do Son July 24, 2026

At a glance Actor / group DPRK-aligned group behind the Contagious Interview campaign (Elastic tracks it as...

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains

Do Son July 24, 2026

At a glance Malware family ACR Stealer (infostealer; linked to a rebrand of Amatera Stealer) Threat actor...

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims Trojanized streaming site causing Packagist themes iOS spyware infections

Trojanized streaming site causing Packagist themes iOS spyware infections

Dolphin X Stealer Sold on a Cybercrime Forum Uses an AI Profiler to Rank Victims

Do Son July 23, 2026

At a Glance Actor or group A vendor using the alias “Kontraktnik”; no real identity published Activity...

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks

Do Son July 21, 2026

At a glance Malware family TELEPUZ Threat actor Unnamed; suspected solo developer or small team running a...

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password

Do Son July 21, 2026

At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or...

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer macOS infostealer posing as Apple crash reporter to steal browser and crypto wallet data

CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords

Do Son July 20, 2026

At a Glance Field Detail Malware family CrashStealer (native C++ macOS infostealer) Threat actor Unattributed; part of...

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users Fake GitHub repositories BoryptGrab infostealer attack chain diagram

292 Fake GitHub Repositories Deliver BoryptGrab Infostealer to Windows Users

Do Son July 17, 2026

At a Glance Malware family BoryptGrab-lineage in-memory infostealer Threat actor Unattributed; financially motivated, likely Russian-speaking Targets Opportunistic...

Malicious OpenClaw Skills on ClawHub Deliver Infostealers and Crypto Fraud Malicious OpenClaw skills on the ClawHub marketplace enabling an AI supply chain attack

Malicious OpenClaw skills on the ClawHub marketplace enabling an AI supply chain attack

Malicious OpenClaw Skills on ClawHub Deliver Infostealers and Crypto Fraud

Do Son July 1, 2026

At a glance Field Detail Actor Unattributed skill publishers; accounts banned by OpenClaw Activity Malicious AI agent...

OXLOADER Malware Loader Spreads CASTLESTEALER via Fake Node.js Ads TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

OXLOADER Malware Loader Spreads CASTLESTEALER via Fake Node.js Ads

Do Son June 26, 2026

At a Glance Malware family OXLOADER (loader) delivering CASTLESTEALER (.NET infostealer) Threat actor Unnamed; suspected Russian-speaking and...

Vidar ABE Bypass Technique Steals Browser Keys Vidar ABE bypass technique flowchart showing how Vidar infostealer malware extracts keys

Vidar ABE Bypass Technique Steals Browser Keys

Do Son June 25, 2026

Gen Digital researchers recently discovered a new Vidar ABE bypass technique. The Vidar infostealer malware extracts the...

Hackers Abused Claude.ai Shared Chat in a ClickFix Malvertising Campaign ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials