Live and recent posts from across the Fediverse tagged #informationstealer, aggregated by home.social.
Lunex Stealer Exploits AMD Driver to Evade Security, Steal Browser Credentials
Meet Lunex Stealer, a sneaky malware that's rapidly spreading across 13 countries, targeting Ukrainian-speaking users with a powerful information-stealing campaign that can swipe browser credentials and more. Its operators have set up 28 unique control panels, making it a growing threat that's hard to ignore.
#LunexStealer #Malwareasaservice #InformationStealer #BrowserCredentials #AmdDriver
AMOS Stealer Evolves with Frequent Changes
Meet AMOS Stealer, a sneaky information thief that's been targeting macOS systems since April 2024, and has recently been upgraded with frequent changes to evade detection. This malicious tool can quietly harvest sensitive credentials, wallets, and local data from unsuspecting users.
#AmosStealer #Macos #InformationStealer #Malware #EmergingThreats
Microsoft Uncovers 30+ Domains Linked to MacSync Stealer Infrastructure
Microsoft's investigation has uncovered a sneaky operation: over 30 domains are secretly linked to MacSync Stealer, a notorious macOS information stealer, and are actively siphoning off sensitive data. The company confirmed that data exfiltration is happening in real-time, not just sending out distress signals.
#MacsyncStealer #InformationStealer #MacosMalware #EmergingThreats #DataExfiltration
AmnesiaStealer Malware Hijacks macOS Browser Sessions with Remote Control
This sneaky malware takes remote control of your macOS browser sessions, allowing hackers to live-stream your screen and even drive your cursor - all without you knowing. They can basically take the reins, controlling your keyboard, mouse, and navigation.
#Amnesiastealer #MacosMalware #BrowserSessionHijacking #RemoteControl #InformationStealer
Malicious VS Code Extensions Target Crypto Wallets, API Keys
Beware: malicious VS Code extensions are targeting crypto wallets and API keys, putting cryptocurrency holders and developers at risk of having their sensitive information stolen. These sneaky extensions, including helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, start off harmless but soon morph into…
#MaliciousVsCodeExtensions #Cryptocurrency #ApiKeyTheft #CredentialTheft #InformationStealer
Windows Stealer Malware Targets 300+ Apps with AI-Powered Profiler
Meet Dolphin X, a sneaky Windows malware that's taking the cybercrime world by storm with its AI-powered profiler and unparalleled ability to infiltrate over 300 apps, swiping sensitive info like browser passwords, crypto wallets, and cloud tokens. This info-stealer is being sold on the dark web as a potent tool for…
#WindowsStealerMalware #AipoweredProfiler #RemoteAccessTrojan #Rat #Informationstealer
ClickLock Malware Forces macOS Users to Reveal Login Passwords
Beware: a sneaky new malware called ClickLock has already compromised over 100 macOS systems in 33 countries, tricking users into revealing their login passwords. This stealthy threat has been hiding in plain sight since May, leaving a trail of vulnerable systems in its wake.
#Macos #ClicklockMalware #InformationStealer #EmergingThreats #Groupib
macOS Malware Exploits User Trust to Steal Sensitive Data
Beware of a sneaky new macOS malware that tricks you into stealing your own sensitive data - all it needs is for you to paste a single command into Terminal. Dubbed ClickLock Stealer, this clever con artist has already duped at least 100 victims across 33 countries.
#MacosMalware #InformationStealer #SocialEngineering #CredentialTheft #EmergingThreats
Microsoft Probes Miasma Campaign as GitHub Repos Remain Offline
Microsoft swiftly took action to safeguard its customers and the broader ecosystem by temporarily removing some GitHub repositories while investigating a software supply chain intrusion. The company has since restored some, but others remain offline as the probe continues.
#SoftwareSupplyChain #Github #Microsoft #EmergingThreats #InformationStealer
PowerShell Stealer Targets Devs via Fake Claude Code Pages
Developers beware: a sneaky PowerShell Stealer is targeting you through fake Claude Code pages, putting your organization's most sensitive assets at risk. Clicking on innocent-looking sponsored search results could be the first step in a devastating cyberattack.
#PowershellStealer #FakeClaudeCode #InformationStealer #SupplyChain #DeveloperTools
Fake Malwarebytes, LastPass, and others on GitHub serve malware https://www.malwarebytes.com/blog/news/2025/09/fake-malwarebytes-lastpass-and-others-on-github-serve-malware #informationstealer #MalwarebytesforMac #Atomicstealer #Threats #GitHub #News #amos
Source Code for mac.c Stealer for macOS Allegedly for Sale https://dailydarkweb.net/source-code-for-mac-c-stealer-for-macos-allegedly-for-sale/ #DarkWebNews&Services #informationstealer #CyberSecurity #maccStealer #databreach #sourcecode #darkweb #malware #macOS
Lumma information stealer infrastructure disrupted https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted #informationstealer #infostealer #Threats #lumma #News
Fake CAPTCHA websites hijack your clipboard to install information stealers https://www.malwarebytes.com/blog/news/2025/03/fake-captcha-websites-hijack-your-clipboard-to-install-information-stealers #informationstealer #clipboardhijacker #Threats #CAPTCHA #News
“Can you try a game I made?” Fake game sites lead to information stealers https://www.malwarebytes.com/blog/news/2025/01/can-you-try-a-game-i-made-fake-game-sites-lead-to-information-stealers #informationstealer #HexonStealer #AgeoStealer #NovaStealer #fakegame #Scams #News
Threat Actors Exploit Microsoft SmartScreen Vulnerability: Cyble Researchers https://thecyberexpress.com/microsoft-smartscreen-vulnerability/ #ThreatIntelligenceNews #TheCyberExpressNews #ThreatIntelligence #InformationStealer #CybersecurityNews #CyberattackNews #TheCyberExpress #FirewallDaily #ThreatActors #Microsoft #cyble
META Stealer Enhances Stealth with Cryptographic Builds in v5.0 Update https://thecyberexpress.com/meta-stealer-v5-0-update/ #TheCyberExpressNews #InformationStealer #CybersecurityNews #TheCyberExpress #METAstealerv50 #FirewallDaily #DarkWebNews #METAstealer #Lumma #Vidar #TLS
Tony Lambert presentation on Detecting and responding to stealer malware in 2024: https://www.youtube.com/watch?v=Pt4GXFhIt4s
Cybercriminals Abusing Stack Overflow to Distribute Malware
Date: May 30, 2024
CVE: Not specified
Vulnerability Type: Social Engineering, Malware Distribution
CWE: [[CWE-494]], [[CWE-434]], [[CWE-22]]
Sources: BleepingComputer
Synopsis
Cybercriminals are exploiting Stack Overflow to distribute malware by posing as helpful users and promoting malicious packages as solutions to programming queries.
Issue Summary
Cybercriminals are posing as users on Stack Overflow to answer questions with solutions that involve installing a malicious PyPi package named 'pytoileur'. This package, part of the "Cool package" campaign, targets Windows users by installing information-stealing malware.
Technical Key Findings
The malicious package 'pytoileur' includes a setup script that contains an obfuscated Base64 encoded command. This command, when decoded, downloads and executes a malware executable disguised as 'runtime.exe'. This malware is designed to steal sensitive information like cookies, passwords, browser history, and other data from web browsers.
Vulnerable Products
Impact Assessment
The malware can steal a wide range of personal and sensitive data, including login credentials, financial information, and personal documents. This data can be sold on dark web markets or used for further cyberattacks.
Patches or Workaround
Developers should always verify the authenticity of packages before installation and inspect the code for any obfuscated or unusual commands. No specific patches are provided, but vigilance in package verification is crucial.
Tags
#Malware #PyPi #Windows #StackOverflow #InformationStealer #Cybersecurity #SocialEngineering #SoftwareDevelopment #PythonPackages
TA547 Shifts Tactics: Leveraging Rhadamanthys Stealer in German-Specific Campaigns
Date: April 10, 2024
CVE: Not applicable
Vulnerability Type: Information Stealer
CWE: N/A
Sources: Proofpoint
Issue Summary
TA547, a financially motivated cybercriminal group, recently initiated an email campaign targeting German organizations, deploying the Rhadamanthys malware. This marks TA547's first recorded use of [[Rhadamanthys stealer]], an advanced information stealer previously utilized by multiple threat actors. The campaign featured emails impersonating the German retail giant Metro, with malicious attachments designed to execute Rhadamanthys without writing to disk, thereby evading typical file-based detection methods.
Technical Key Findings
The attack chain involves emails with a password-protected ZIP file attachment containing an LNK file. Execution of the LNK file triggers a PowerShell script that decodes and runs the [[Rhadamanthys stealer]] directly in memory. Notably, the PowerShell script exhibited signs of being generated by a Large Language Model (LLM), indicative of TA547's potential use of advanced AI tools for crafting malware delivery mechanisms.
Vulnerable products
Impact assessment
[[Rhadamanthys stealer]] is designed to steal sensitive information, including credentials and financial data. Successful deployment within organizations can lead to significant data breaches, financial loss, and reputational damage.
Patches or workaround
While the report does not specify patches, organizations are advised to enhance email filtering, educate employees on phishing, and deploy behavior-based detection mechanisms to mitigate threats posed by memory-resident malware and sophisticated delivery scripts.
Tags
#TA547 #Rhadamanthys #InformationStealer #Germany #Cybercrime #MalwareCampaign #PowerShell #AI_Malware
The Comeback of WarzoneRAT: Analyzing the Latest Multi-Stage Attacks https://thecyberexpress.com/warzonerat-returns-amid-fbi-crackdown/ #TheCyberExpressNews #InformationStealer #TheCyberExpress #FirewallDaily #DarkWebNews #WarzoneRAT #Avemaria #darkweb #FBI #RAT
Xehook Stealer: Evolution from Cinoshi Project to an Advanced Crypto-Stealing Malware https://thecyberexpress.com/xehook-stealer-arrives-on-dark-web/ #InformationStealer #TheCyberExpress #Agnianestealer #Cinoshiproject #FirewallDaily #XehookStealer #DarkWebNews
Dark Web Actor Selling Source Code for Rust-Based Information Stealer https://thecyberexpress.com/source-code-sale-of-new-information-stealer/ #informationstealers #InformationStealer #TheCyberExpress #FirewallDaily #AtomicStealer #AsukaStealer #DarkWebNews #InfoStealer #Crackingx
The Intricacies of Atomic Stealer (AMOS) and the Emergence of Xehook Stealer on Dark Web https://thecyberexpress.com/atomic-stealer-amos-and-xehook-stealer/ #InformationStealer #TheCyberExpress #FirewallDaily #AtomicStealer #XehookStealer #DarkWebNews #AMOSStealer #AMOS
Unveiling the Latest Threat: A MacOS Stealer Emerges on the Dark Web https://thecyberexpress.com/macos-stealer-alert-on-dark-web/ #MacOSInformationStealer #InformationStealer #PANDAthreatactor #TheCyberExpress #FirewallDaily #MacOSstealer #DarkWebNews
Cyber Espionage Strikes Indian Air Force: Malware Disguised in ‘SU-30 Aircraft Procurement’ File https://thecyberexpress.com/cyberattack-on-the-indian-air-force/ #cyberattackontheIndianAirForce #TheCyberExpressNews #InformationStealer #TheCyberExpress #IndianAirForce #FirewallDaily #Espionage #GoStealer
Unmasking the Resurgence of Azorult Malware: Cyble Detects A New Dark Web Campaign https://thecyberexpress.com/azorult-malware-resurgence-cyble-reports/ #TheCyberExpressNews #InformationStealer #Azorultcampaign #TheCyberExpress #Azorultmalware #FirewallDaily #DarkWebNews #darkweb
Unraveling the Intricacies of qBit Stealer: A New Information Stealer on the Market https://thecyberexpress.com/qbit-stealer-source-code-on-sale/ #TheCyberExpressNews #InformationStealer #TheCyberExpress #FirewallDaily #DarkWebNews #qBitstealer
Revealing the Editbot Stealer: A Python-Based Threat Targeting Social Media Users https://thecyberexpress.com/editbot-stealer-information-stealer/ #Python-Basedinformationstealer #TheCyberExpressNews #InformationStealer #TheCyberExpress #EditbotStealer #FirewallDaily #DarkWebNews
Laze Stealer Added to GitHub: A Powerful Stealer in Development Phase https://thecyberexpress.com/laze-stealer-new-information-stealer/ #newinformationstealer #TheCyberExpressNews #InformationStealer #TheCyberExpress #FirewallDaily #DarkWebNews
ExelaStealer: A New Low-Cost Cybercrime Weapon Emerges
https://thehackernews.com/2023/10/exelastealer-new-low-cost-cybercrime.html #Cybercrime #Malware #InformationStealer #ExelaStealer