Infostealer Archives • Page 3 of 8 • Daily CyberSecurity

VoidStealer Debuts Novel Debugger Bypass for Chrome and Edge Encryption

VoidStealer Debuts Novel Debugger Bypass for Chrome and Edge Encryption

Do Son March 25, 2026

Gen Threat Labs uncovers VoidStealer, the first malware using a debugger-based bypass to extract Chrome and Edge encryption keys via hardware breakpoints.

SEO Poisoning and “ClickFix” Tactics: The Rise of MacSync Stealer OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

SEO Poisoning and “ClickFix” Tactics: The Rise of MacSync Stealer

Do Son March 23, 2026

Beware of "MacSync Stealer": A new macOS malware campaign using SEO poisoning and terminal commands to hijack crypto wallets and system keys.

Malicious Windsurf IDE Extension Uses Solana Blockchain to Steal Developer Data Windsurf Stealer Solana Blockchain Malware

Malicious Windsurf IDE Extension Uses Solana Blockchain to Steal Developer Data

Do Son March 22, 2026

Bitdefender uncovers a malicious Windsurf IDE extension using the Solana blockchain as an unblockable C2 to steal developer credentials and source code.

Game Over: Vidar Stealer 2.0 is Hijacking Gamers with Fake Cheats DriverFixer0428, Contagious Interview Cache Smuggling, ClickFix Evasion North Korean Cyber Espionage

DriverFixer0428, Contagious Interview Cache Smuggling, ClickFix Evasion North Korean Cyber Espionage

Game Over: Vidar Stealer 2.0 is Hijacking Gamers with Fake Cheats

Do Son March 20, 2026

Acronis uncovers a massive campaign targeting gamers with fake cheats to deliver Vidar Stealer 2.0, a highly evasive malware stealing crypto and passwords.

The CAPTCHA Trap: How a Global ‘ClickFix’ Campaign Weaponizes WordPress to Drain Digital Wallets ClickFix Campaign WordPress Malware

The CAPTCHA Trap: How a Global ‘ClickFix’ Campaign Weaponizes WordPress to Drain Digital Wallets

Do Son March 18, 2026

Rapid7 exposes a global ClickFix campaign hijacking WordPress sites with fake Cloudflare CAPTCHAs to deliver stealthy infostealers and drain digital wallets.

Fake GitHub Repositories Unleash BoryptGrab Stealer and TunnesshClient Backdoor TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Fake GitHub Repositories Unleash BoryptGrab Stealer and TunnesshClient Backdoor

Do Son March 9, 2026

Trend Micro reveals the BoryptGrab info stealer campaign using SEO-optimized fake GitHub repos to deploy the TunnesshClient reverse SSH backdoor.

AuraStealer: The “Result-Oriented” Malware Rising from the Post-Lumma Void AuraStealer Malware Infostealer

AuraStealer: The “Result-Oriented” Malware Rising from the Post-Lumma Void

Do Son March 4, 2026

Following the Lumma takedown, the sophisticated AuraStealer malware is rapidly gaining ground, using TikTok scams and stealth to harvest data.

The High Cost of ‘Free’: How PiviGames Became a Lovecraftian Malware Hub for HijackLoader and ACRStealer Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

The High Cost of ‘Free’: How PiviGames Became a Lovecraftian Malware Hub for HijackLoader and ACRStealer

Do Son March 3, 2026

G DATA reveals how pirated gaming site PiviGames distributes ACRStealer via "spaghetti code" HijackLoader and DLL sideloading, causing total account takeovers.

The “Windows + R” Trap: ClickFix Scam Tricks Users into Installing StealC Malware StealC Malware ClickFix Campaign

The “Windows + R” Trap: ClickFix Scam Tricks Users into Installing StealC Malware

Do Son February 16, 2026

LevelBlue warns of StealC malware using "ClickFix" fake CAPTCHAs. Users are tricked into running fileless malware via PowerShell. Stay alert.

The Human Hack: LummaStealer Returns with Deceptive “ClickFix” Attacks Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

The Human Hack: LummaStealer Returns with Deceptive “ClickFix” Attacks

Do Son February 13, 2026

LummaStealer is back, evading takedowns with "ClickFix" tactics. Bitdefender reveals how fake CAPTCHAs trick users into running malware. Stay alert.

Weaponized Code: LTX Stealer Abuses Node.js to Bypass Antivirus LTX Stealer Node.js Malware

Weaponized Code: LTX Stealer Abuses Node.js to Bypass Antivirus

Do Son February 12, 2026

New LTX Stealer malware abuses Node.js & Inno Setup to bypass antivirus. This $10 tool steals browser passwords & crypto wallets. Stay alert.

Macs Under Siege: New Infostealers Spread via WhatsApp & Fake Apps OSX/Amos Stealer Electron ASAR Trojan MioLab Malware macOS Security MacSync Stealer macOS Malware ambar-src npm Malware Supply Chain Typosquatting Matryoshka Mac Malware ClickFix Crypto Scam Infostealer Evolution macOS Malware Predator Spyware Intellexa Anti-Analysis XCSSET macOS Malware, Xcode Supply Chain

Macs Under Siege: New Infostealers Spread via WhatsApp & Fake Apps

Do Son February 6, 2026

Microsoft warns: Infostealers now target macOS & use WhatsApp worms. "Eternidade" & "Crystal PDF" steal credentials via cross-platform attacks.

Open VSX Hijacked: “GlassWorm” Malware Poisons VS Code Extensions

Do Son February 5, 2026

GlassWorm malware found in Open VSX extensions. Hackers stole AWS & SSH keys from macOS devs using Solana C2. 22k+ downloads affected. Check your tools.

Digital Ghost: “PhantomVAI” Malware Revives Decade-Old RunPE Tricks PhantomVAI Loader RunPE Malware

Digital Ghost: “PhantomVAI” Malware Revives Decade-Old RunPE Tricks

Do Son February 4, 2026

New "PhantomVAI" malware recycles old Hackforums "RunPE" code to bypass modern EDR. Campaigns use task scheduler masquerading to deliver infostealers.

“G_Wagon” Malware Hides in Fake NPM UI Library to Steal Cloud Keys Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

“G_Wagon” Malware Hides in Fake NPM UI Library to Steal Cloud Keys

Do Son January 27, 2026

Malicious npm package "ansi-universal-ui" drops "G_Wagon" infostealer to steal cloud keys and wallets. Check for .gwagon_status and rotate creds now.

Mac Users Beware: “MacSync” Malware Tricks You Into Hacking Yourself MacSync Malware macOS ClickFix

Mac Users Beware: “MacSync” Malware Tricks You Into Hacking Yourself

Do Son January 23, 2026

New macOS malware "MacSync" uses fake cloud installers & "ClickFix" terminal commands to steal crypto. It bypasses Gatekeeper to trojanize wallet apps.

Hidden in Plain Site: PURELOGS Stealer Hides Malware in Archive.org Images PURELOGS Stealer Archive.org Phishing

Hidden in Plain Site: PURELOGS Stealer Hides Malware in Archive.org Images

Do Son January 21, 2026

New PURELOGS campaign uses Archive.org images to hide malware. For just $150, this MaaS steals crypto & passwords via fileless attacks. Spot the signs.

“Evelyn Stealer” Weaponizes Visual Studio Code Extensions KTLVdoor backdoor - CoffeeLoader Malware

“Evelyn Stealer” Weaponizes Visual Studio Code Extensions

Do Son January 21, 2026

Trend Micro reveals Evelyn Stealer, a malware campaign weaponizing Visual Studio Code extensions. It uses DLL injection to steal developer secrets & crypto.

Discord Spy: SolyxImmortal Malware Uses Webhooks for Stealthy Theft SolyxImmortal Malware Python Info-Stealer Discord Webhook C2, Supply Chain Abuse

SolyxImmortal Malware Python Info-Stealer Discord Webhook C2, Supply Chain Abuse

Discord Spy: SolyxImmortal Malware Uses Webhooks for Stealthy Theft

Do Son January 20, 2026

CYFIRMA reveals SolyxImmortal, a Python info-stealer using Discord webhooks for C2. It logs keys and steals files while evading detection.

Trojanized PDF Editor: “TamperedChef” Campaign Bypasses Windows SmartScreen TamperedChef Malvertising AppSuite PDF Editor

Trojanized PDF Editor: “TamperedChef” Campaign Bypasses Windows SmartScreen

Do Son January 20, 2026

Sophos reveals "TamperedChef" malvertising. Fake "AppSuite PDF Editor" uses valid EV certs to deploy infostealers globally. Check your systems now.

Fake Windows Executables Target macOS: Inside the “MonetaStealer” Discovery MonetaStealer macOS Malware

Fake Windows Executables Target macOS: Inside the “MonetaStealer” Discovery

Do Son January 20, 2026

New macOS malware "MonetaStealer" disguises itself as a Windows .exe to steal crypto & Keychain data. It currently has zero VirusTotal detection.

Fake Malwarebytes Campaign Exploits DLL Sideloading to Drop Infostealers GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

Fake Malwarebytes Campaign Exploits DLL Sideloading to Drop Infostealers

Do Son January 19, 2026

New malware campaign impersonates Malwarebytes installers. Hackers use DLL sideloading to deploy infostealers targeting crypto & MFA. Verify downloads now.