Do Son Unit 42 unmasks VVS Stealer, a Python-based threat using Pyarmor obfuscation to bypass AV, hijack Discord sessions, and steal browser credentials.
Infostealer
EmEditor confirms its official site was compromised, redirecting users to a malicious MSI signed by WALSHAM INVESTMENTS LIMITED to steal sensitive data.
Intrinsec’s 2025 report unmasks "Fly," the elusive operator of Russian Market, linking the decade-old bazaar to early malware and BTC-E laundering.
Jamf uncovers a new MacSync Stealer variant that was notarized by Apple, allowing it to bypass Gatekeeper and infect Macs without terminal commands.
Gen Digital uncovers AuraStealer, a new infostealer using TikTok "Scam-Yourself" tactics to trick users into infecting their own Windows PCs.
Check Point Research exposes the YouTube Ghost Network, using GachiLoader to spread Rhadamanthys infostealer through cracked software and game cheats.
G DATA exposed Arkanix, a fast-evolving C++ stealer. Its premium version uses process injection and Chrome Elevator to bypass Chrome App-Bound Encryption (ABE) and steal crypto wallets and Wi-Fi passwords.
The malicious 'Crypto Copilot' Chrome extension drains Solana funds from traders on X by injecting hidden transfers. Remove this malware immediately.
Cybercriminals are using fake Battlefield 6 cracks and trainers to deploy infostealers. Avoid "InsaneRamZes" & "RUNE" torrents to protect your data.
Alert: Malicious Blender files are delivering StealC V2 infostealer. 3D artists downloading from free sites are at risk. Disable auto-run scripts now.
Splunk uncovered a new .NET steganographic loader that hides LokiBot malware inside embedded BMP and PNG image files. The multi-stage loader uses a separate container module, evading static detection.
Jamf exposed DigitStealer, an advanced macOS infostealer that checks for Apple M2+ chips. It uses Cloudflare Pages for delivery, JXA for stealth, and modifies Ledger Live to steal crypto wallets via DNS TXT C2.
Despite a recent doxxing attempt, Lumma Stealer has resurfaced, integrating browser fingerprinting into its C&C to collect WebGL/Canvas signatures for sandbox evasion and victim assessment.
Datadog exposed MUT-4831, a cluster that deployed Vidar Infostealer via 17 malicious npm packages. The malware uses postinstall scripts to download and execute the payload, stealing credentials and crypto wallets.
Socket exposed an npm typosquat campaign using 10 fake packages (Netherеum.All). The malicious postinstall script deploys a 24MB PyInstaller stealer after prompting a fake CAPTCHA.
AhnLab exposed Rhadamanthys Infostealer hiding in games built with the Ren'Py engine. It uses a fake 1M-second loading screen to distract victims while injecting malware via a malicious Python script.
Google denies claims of a mass Gmail breach, clarifying that a new HIBP dump of 183M credentials stems from third-party infostealer malware, not a platform hack.
Netskope found the RedTiger Python tool repurposed as an infostealer targeting gamers. It uses Discord injection to steal tokens/payment data and GoFile for anonymous data exfiltration, spamming files/processes for evasion.
Check Point exposed the YouTube Ghost Network, a coordinated op using 3,000+ videos (Game/Software Cracks) to spread Rhadamanthys/Lumma infostealers via fake engagement and external file hosts.
Netskope exposed a Python RAT (Nursultan Client) disguised as a Minecraft tool. It uses the Telegram Bot API for C2 to steal Discord tokens, credentials, and capture screenshots on Windows, Linux, and macOS.
Vidar 2.0, fully rewritten in C, is a multithreaded infostealer that bypasses Chrome's AppBound encryption via memory injection to steal crypto wallets and credentials. Its adoption spikes as Lumma declines.
FortiGuard Labs identified a new Stealit malware variant abusing Node.js SEA for stealthy distribution. The campaign features a public C2 panel and uses Telegram for data exfiltration.