#infostealers — Public Fediverse posts

MacSync Malware Evolves With New Delivery Methods

Meet the latest evolution of MacSync malware, which has upgraded its delivery methods with compiled binaries, Objective-C and Swift modules, and clever use of Apple infrastructure to spread its reach. This rapidly changing threat was first spotted in the wild in September 2026, and it's getting more sophisticated by the minute.

https://osintsights.com/macsync-malware-evolves-with-new-delivery-methods?utm_source=mastodon&utm_medium=social

#MacsyncMalware #EmergingThreats #CryptoStealers #InfoStealers #Objectivec

Anthropic boots users, wipes payment info to protect against malware attack - ZDNET https://www.zdnet.com/tech/anthropic-boots-users-wipes-payment-info-to-protect-against-infostealer-malware/ #Anthropic #Claude #Infostealers #Password #UsageCredits

Infostealers Hijack Claude AI Sessions and Drain Paid Subscriptions

Anthropic confirms multiple malware families can steal active Claude login sessions, bypass two-factor authentication, and burn through paid usage

https://pulseofnations.lol/infostealers-hijack/

#AiSecurity #Anthropic #Claude #Cybercrime #Infostealers #Malware #SessionHijacking

Infostealer Malware Harvests 1.7 Billion Credentials in Six Months - https://www.redpacketsecurity.com/infostealers-harvest-1-7-billion-credentials-in-six-months/

#threatintel #Infostealers #Vulnerabilities #Ransomware

Billions of stolen browser cookies are fueling silent account hijacking—no password needed. https://jpmellojr.blogspot.com/2026/08/billions-of-stolen-browser-cookies-fuel.html #NordVPN #Cookies #AccountHijacking #malware #InfoStealers

https://www.europesays.com/pt/474485/ Cibercriminosos roubam 52,4 mil milhões de cookies. Dados dos navegadores são um alvo cada vez mais valioso #browsers #Cibersegurança #Ciência #CiênciaETecnologia #CiênciaEtecnologia #cookies #Infostealers #Internet #navegadores #NordVPN #Portugal #PT #Science #ScienceAndTechnology #ScienceAndTechnology #Technology #Tecnologia

Discover VMRay Labs' execution-level analysis of Operation STANDOFF, a Russian-speaking multi-operator campaign deploying stealer malware and AI bots.

#OperationSTANDOFF #VMRayLabs #MalwareAnalysis #Infostealers #Cybersecurity

https://meterpreter.org/operation-standoff-intrusion-campaign/?utm_source=mastodon&utm_medium=jetpack_social

Newly discovered PamStealer isn’t your typical macOS malware

The discovery underscores the increased effort being poured into Mac infostealers.

Archive: ia: https://s.faithcollapsing.com/tpbfx

#apple #biz-&-it #infostealers #macos-malware #security
https://arstechnica.com/security/2026/07/new-pamstealer-macos-malware-uses-clever-tradecraft-to-remain-stealthy/

Newly discovered PamStealer isn’t your typical macOS malware

The discovery underscores the increased effort being poured into Mac infostealers.

Archive: ia: https://s.faithcollapsing.com/tpbfx
https://s.faithcollapsing.com/r2cy1#apple #biz-&-it #infostealers #macos-malware #security

 

 

Newly discovered PamStealer isn’t your typical macOS malware

The discovery underscores the increased effort being poured into Mac infostealers.

Archive: ia: https://s.faithcollapsing.com/tpbfx
https://s.faithcollapsing.com/r2cy1#apple #biz-&-it #infostealers #macos-malware #security

 

 

StealC and Amadey: Breaking down infostealers and the cybercrime services thatdeliver them - https://www.redpacketsecurity.com/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-thatdeliver-them/

#threatintel
#infostealers
#StealC
#Amadey
#malware-as-a-service
#cybercrime-economy

Europol-led Operation Endgame Disrupts StealC and Amadey Infostealers Infrastructure - https://www.redpacketsecurity.com/europol-led-operation-endgame-takes-down-stealc-and-amadey-infostealers/

#threatintel #Operation_Endgame #AI_takedown #infostealers

Lees tip -> Politie haalt malware StealC en Amadey offline in Operatie Endgame | Bij een internationale actie tegen infostealers zijn criminele servers offline gehaald. Politie vond ruim 24 miljoen logingegevens van zeker 384.000 besmette systemen. | #ransomware #politie #infostealers #Europol #cybercrime #StealC #malware #Eurojust #OperatieEndgame #Amadey |

https://hbpmedia.nl/politie-haalt-malware-stealc-en-amadey-offline-in-operatie-endgame/

Malicious AI Skills Evade Detection on ClawHub Marketplace

Malicious AI skills are slipping through the cracks on ClawHub, with nearly 1 in 5 skills analyzed carrying hidden threats, and a recent audit found a thriving marketplace for bad actors to exploit. Unit 42 uncovered alarming trends, including infostealers and evasion techniques, highlighting the need for vigilance in this rapidly…

https://osintsights.com/malicious-ai-skills-evade-detection-on-clawhub-marketplace?utm_source=mastodon&utm_medium=social

#MaliciousAiSkills #Clawhub #Infostealers #EvasionTechniques #EmergingThreats

Los infostealers roban contraseñas, cookies y sesiones sin hacer ruido. Así operan, qué buscan y por qué son tan peligrosos. #Ciberseguridad #Malware #Infostealers #Contraseñas #Ransomware #SeguridadDigital

https://donporque.com/que-es-infostealer/

Cyber Thieves Exploit SEO to Spread Infostealers via Fake AI Sites

Cyber thieves are using clever SEO tricks to spread infostealers through fake AI sites, targeting enterprise users and developer workstations with a potent mix of imitation and in-memory malware. This brief but potent campaign has been meticulously planned, with malicious domains deployed as early as March 2026.

https://osintsights.com/cyber-thieves-exploit-seo-to-spread-infostealers-via-fake-ai-sites?utm_source=mastodon&utm_medium=social

#Infostealers #SeoManipulation #EnterpriseSecurity #MalwareOperations #InmemoryMalware

Malicious AI Browser Extensions Exfiltrate User Data

Beware of AI browser extensions that promise to boost productivity but secretly steal your data. Researchers uncovered 18 malicious extensions that masquerade as helpful tools but deliver spyware, Trojans, and other threats that can hijack your online activity.

https://osintsights.com/malicious-ai-browser-extensions-exfiltrate-user-data?utm_source=mastodon&utm_medium=social

#MalwareOperations #AiBrowserExtensions #EmergingThreats #RemoteAccessTrojans #Infostealers

Kaspersky Report Warns of Evolving Financial Cyberthreats

Stay ahead of financial cyber threats with Kaspersky's expert report, which reveals the latest trends and patterns from 2025 and offers a crucial outlook for 2026. Discover how phishing, PC malware, and infostealers are shaping the threat landscape and what it means for your financial security.

https://osintsights.com/kaspersky-report-warns-of-evolving-financial-cyberthreats?utm_source=mastodon&utm_medium=social

#FinancialCyberThreats #EmergingThreats #Phishing #PcMalware #Infostealers

Ataques silenciosos: así están robando tu información personal

Ataques silenciosos: así están robando tu información personal
San José, 06 abr (elmundo.cr) – Investigadores de ESET analizaron la evolución reciente de los infostealers, un tipo de malware diseñado para robar información sensible como credenciales de acceso, datos financieros o información almacenada en navegadores. A partir de los datos relevado [...]

#CienciaYTecnología #ESET #Infostealers #Malware #NFC

https://elmundo.cr/cienciaytecnologia/ataques-silenciosos-asi-estan-robando-tu-informacion-personal/

Panorama de la actividad actual de infostealers y el robo de credenciales

Investigadores de ESET analizaron la evolución reciente de los infostealers, un tipo de malware diseñado para robar información sensible como credenciales de acceso, datos financieros o información almacenada en navegadores. A partir de los datos relevados en los últimos ESET Threat Reports, se observa que durante 2025 el panorama de estas amenazas experimentó cambios importantes (Fuente ESET Latam).

Tras el abandono del desarrollo de Agent Tesla por parte de sus creadores, otras familias de malware como Formbook y SnakeStealer tomaron protagonismo en el ecosistema de robo de información. Si bien las detecciones globales de infostealers disminuyeron un 18% durante el segundo semestre de 2025, los especialistas advierten que las campañas se volvieron más sofisticadas, impulsadas por nuevas técnicas de ingeniería social y el uso de inteligencia artificial.

“Los infostealers siguen siendo una de las herramientas favoritas de los cibercriminales porque permiten robar grandes volúmenes de credenciales e información sensible de forma silenciosa. Aunque en el último año vimos una disminución en el volumen de detecciones, también observamos una evolución en su sofisticación, con campañas mejor dirigidas y el uso de nuevas tecnologías para optimizar los ataques”, comenta David González, Especialista en Seguridad Informática de ESET Latinoamérica.

Las familias de malware con mayor impacto en la región

De acuerdo con la telemetría de ESET, estas son algunas de las familias de infostealers con mayor presencia en Latinoamérica:

Formbook (Win/Formbook). Fue la familia más detectada a nivel global al cierre de 2025, con 17,3% del total de detecciones, principalmente distribuida a través de campañas de phishing.
Lumma Stealer (Win/Spy.LummaStealer). Protagonista de ataques masivos dirigidos especialmente a usuarios en México, enfocados en el robo de credenciales y datos almacenados en navegadores.
Agent Tesla (MSIL/Spy.AgentTesla). A pesar de la desaceleración en su desarrollo, continúa siendo ampliamente distribuido mediante descargadores de malware como CloudEyE (GuLoader).
NGate / PhantomCard (Android/Spy.NGate). Una amenaza de spyware móvil orientada principalmente al ecosistema bancario brasileño, con capacidades para robar contactos y datos de tarjetas.
Spy.Banker_(JS/Spy.Banker). Troyanos basados en JavaScript que afectan principalmente a usuarios de servicios financieros y registran una tasa de detección global cercana al 9,5%.

Latinoamérica, un objetivo relevante

El análisis también muestra que Latinoamérica se consolidó como una región de interés para los cibercriminales.

En México, por ejemplo, el 8 de julio de 2025 se registró un pico que concentró el 70% de las detecciones globales de Lumma Stealer, a raíz de una campaña masiva de spam con señuelos en español.

Brasil, por su parte, se posicionó como uno de los principales focos de fraudes mediante tecnología NFC, con malware móvil que suplanta a bancos y plataformas de comercio electrónico.

Otros países de la región también registraron actividad relevante. En Perú, por ejemplo, se detectó un alto volumen de ataques que utilizan la técnica ClickFix, mientras que Chile reportó presencia de NGate, una avanzada herramienta de espionaje vinculada a ataques mediante NFC. En tanto, Colombia y Argentina mantienen una presencia constante en los mapas de detección de infostealers.

Cómo se distribuyen estas amenazas

Entre los principales vectores de infección se destacan:

• Phishing y spam localizado, con archivos adjuntos maliciosos que simulan facturas o pedidos.
• ClickFix, una técnica de ingeniería social que muestra falsos errores del sistema o invita a activar un software para dejarlo totalmente funcionable o desbloquear nuevas características de paga; en ambos casos se busca convencer al usuario de ejecutar comandos maliciosos.
• Descargadores de malware, como CloudEyE (GuLoader), que experimentaron un fuerte crecimiento durante el segundo semestre de 2025.
• Sitios web fraudulentos, que suplantan tiendas oficiales como Google Play para distribuir aplicaciones maliciosas.

Conclusión

Durante 2025 los infostealers redujeron su volumen, pero aumentaron en sofisticación, impulsados por el uso de inteligencia artificial y el crecimiento del modelo Malware-as-a-Service (MaaS). En este contexto, Latinoamérica se consolidó como un objetivo clave para los cibercriminales. De cara a 2026, los especialistas destacan la importancia de reforzar la protección de credenciales, mejorar la detección temprana de estas amenazas y fortalecer la seguridad en entornos móviles y tecnologías como NFC, cada vez más utilizadas en ataques financieros.

This campaign reinforces a critical shift: infostealers are no longer just credential hunters - they’re context harvesters.

AI agents storing plaintext memories, tokens, and configs create a rich target set for commodity malware. Once a host is compromised, attackers don’t need exploits - just file access.

Source: https://www.infostealers.com/article/ai-agents-most-downloaded-skill-is-discovered-to-be-an-infostealer/

💬 How should AI agent data be classified in security models?
🔔 Follow TechNadu for threat-focused, non-sensational analysis

#InfoSec #ThreatModeling #AIrisk #Infostealers #EndpointSecurity #MaaS #TechNadu

Enterprise credentials exposed by infostealers #CyberSecurity #InfoStealers

https://betanews.com/article/enterprise-credentials-exposed-by-infostealers/

ClawdBot - công cụ AI mới trở thành mục tiêu chính của các phần mềm lấy cắp thông tin (infostealers) trong kỷ nguyên AI. Cảnh báo an ninh số đáng chú ý.
#BảoMậtAI #PhầnMềmGiánĐiệp #AISecurity #Infostealers @u/Malwarebeasts

https://www.reddit.com/r/programming/comments/1qo93n5/clawdbot_the_new_primary_target_for_infostealers/

PcComponentes confirms incident was credential stuffing — not a system breach.

Attackers used historical infostealer logs to access accounts and scrape PII.

https://www.technadu.com/pccomponentes-incident-was-a-credential-stuffing-attack-using-infostealer-logs/618878/

Thoughts?
#CredentialStuffing #Infostealers #InfoSec

Actor claims sale of 8M Armenian government records.

Officials deny email system breach but confirm investigation into a civil litigation platform. Researchers suggest infostealer-sourced data.

https://www.technadu.com/8-million-armenian-government-records-allegedly-sold-on-hacker-forum-officials-deny-breach/618159/

#CyberSecurity #DataLeak #Infostealers

Researchers say a lone attacker accessed internal systems at around 50 companies worldwide using infostealer malware and stolen credentials, often where MFA was not enabled, and is offering the access for sale.

Read: https://hackread.com/lone-hacker-infostealers-global-companies-data/

#CyberSecurity #Infostealers #Malware #MFA #Infosec

The confirmed WIRED database leak, validated through infostealer telemetry, illustrates how credential compromise can evolve into mass data exposure.

Claims of a forthcoming Condé Nast dataset raise the potential impact significantly, including targeted phishing, identity abuse, and physical safety risks tied to exposed addresses. The case also highlights challenges around disclosure responsiveness and third-party data visibility.

Thoughts from practitioners on detection, disclosure, or mitigation approaches are welcome.

Follow @technadu for practitioner-focused cybersecurity reporting.

Source: https://www.infostealers.com/article/wired-database-leaked-40-million-record-threat-looms-for-conde-nast/

#InfoSec #ThreatIntelligence #DataBreach #Infostealers #ExposureRisk #CyberDefense

На маркетплейсі Microsoft для Visual Studio Code знайшли два шкідливі розширення, які заражають машини розробників стилерами. Малвар вміє робити скріншоти, красти паролі та криптогаманці, а також перехоплювати браузерні сесії.

The VS Code Malware That Captures Your Screen | Koi Blog
https://www.koi.ai/blog/the-vs-code-malware-that-captures-your-screen

#malware #infostealers #windows #vscode #vscode_extention

The hidden costs of illegal streaming and modded Amazon Fire TV Sticks https://www.malwarebytes.com/blog/news/2025/11/illegal-streaming-is-costing-people-real-money-research-finds #infostealers #FireSticks #streaming #Threats #News

Lees tip -> Operatie Endgame schakelt grote cybernetwerken uit | In Operatie Endgame zijn grote cybernetwerken uitgeschakeld, met aanhoudingen, neergehaalde servers en verstoring van infostealers, botnets en RAT’s door internationale samenwerking. | #botnet #cybercrime #Europol #hacking #infostealers #internationalesamenwerking #OperatieEndgame #politie #ransomware #Rhadamanthys #VenomRAT |

https://hbpmedia.nl/operatie-endgame-cybernetwerken-uitgeschakeld/

Fake CAPTCHA sites now have tutorial videos to help victims install malware https://www.malwarebytes.com/blog/news/2025/11/fake-captcha-sites-now-have-tutorial-videos-to-help-victims-install-malware #infostealers #fakeCaptcha #clickfix #Threats #News

#infosec #malware #infostealers

3000 YouTube videos Exposed as Malware

https://thehackernews.com/2025/10/3000-youtube-videos-exposed-as-malware.html?m=1&s=09

Rival hackers have doxxed the alleged operators behind #LummaStealer, one of the biggest data-theft malware services. The leaks have caused internal chaos and slowed its growth.

Read: https://hackread.com/rival-hackers-dox-lumma-stealer-operators/

#CyberSecurity #Malware #InfoStealers #InfoSec #CyberCrime

How infostealers have changed the cybersecurity landscape #CyberSecurity #Infostealers

https://betanews.com/2025/10/22/how-infostealers-have-changed-the-cybersecurity-landscape/

A seemingly routine tool update could be a trap—malware like AMOS and Odyssey are stealthily targeting macOS developers and snatching credentials and source code. Are you prepared for this new wave of cyber threats?

https://thedefendopsdiaries.com/the-rise-of-infostealers-amos-and-odyssey-target-macos-developers/

#macossecurity
#infostealers
#cyberthreats
#amosmalware
#odysseymalware

The Register: FileFix attacks use fake Facebook security alerts to trick victims into running infostealers. “An attack called FileFix is masquerading as a Facebook security alert before ultimately dropping the widely used StealC infostealer and malware downloader on Windows machines.”

https://rbfirehose.com/2025/09/20/the-register-filefix-attacks-use-fake-facebook-security-alerts-to-trick-victims-into-running-infostealers/

I grew tired of feeling helpless against supply-chain attacks that steal credentials (#infostealers), so I created a program that reliably detects & stops them on macOS, Linux, and other OS's. What should I call it?

🚨 PayPal credentials leak claim 🚨
Hacker “Chucky_BF” is offering 15.8M PayPal login pairs (emails + plaintext passwords).

Troy Hunt: “Given passwords definitely didn’t come from PayPal in plain text, they’ve either been obtained another way (infostealer, credential stuffing) or there’s another explanation for this claim.”

⚠️ Possible sources: malware, reused credentials, or stuffing attacks.

Details ➡️ https://www.technadu.com/almost-16-million-paypal-credentials-leak-claim-sparks-security-concerns/606322/

#CyberSecurity #PayPal #Infostealers

🔐 Compromised credentials are just the beginning.

Splunk's PLoB project builds AI fingerprints of post-login behavior to spot intrusions—before attackers gain persistence.
✅ AI vectors
✅ Cosine similarity
✅ Human-style context summaries
✅ Detects both weird users and bots

Behavioral threat hunting, redefined.
#CyberSecurity #Infostealers #BehavioralDetection

A major leak has revealed the operations behind North Korea’s state-linked IT workforce.

Slack logs and spreadsheets show how coders apply for remote gigs worldwide, sending back an estimated $600M/year to fund a heavily sanctioned regime.

#NorthKorea #CyberThreatIntel #Infostealers #sanctionsevasion #APT

I have this low effort/quality blog, where I weekly post about infostealers: cryptolek.info. One of the sections in stealer posts is "Marketplace Updates," where I grab some numbers from the marketplaces, like numbers of victims based on stealers, top 5 countries, and Nordic countries.

2 weeks ago, I was chatting with a friend and decided I could just post numbers for all the countries. If you need numbers of victims per country on Russian Market and Exodus Market, for your "threat intel" needs, here's a CryptPad spreadsheet:
https://cryptpad.fr/sheet/#/2/sheet/view/Nb6mNBqf9DvzyI8BnlkjvTx-MwEmycXPsqHvrU22iUM/embed/

#infostealers #RussianMarket #ExodusMarket #threatintel

PC World: A U.S. startup is selling your stolen data to anyone with $50. “That company is Farnsworth Intelligence, an ‘open-source intel’ startup from 23-year-old founder Aidan Raney. And it’s not being coy about what it’s doing. The company’s primary consumer-level product is called ‘Infostealers,’ and it’s hosted at Infostealers.info. (Yup, what a URL.) According to an exposé from […]

https://rbfirehose.com/2025/07/25/pc-world-a-u-s-startup-is-selling-your-stolen-data-to-anyone-with-50/

💻 Threat Intel: FMovies Pirate Site Delivered Infostealers at Scale
Recent analysis links FMovies to a massive infostealer malware campaign:

• 30K infections (Lumma, StealC, Vidar, RedLine, Raccoon)
• Methods: Cookie theft, JS-injected ads, fake video buttons
• Over 15K affected users, 10K+ leaked credentials
• Only 12.9% of passwords are classified as strong
• Source: Hudson Rock via Microsoft + TorrentFreak

The platform shut down in August 2024, but infected cookies are still being traded.

🔗 Read full intel: ⬇️
https://technadu.com/fmovies-pirate-website-linked-to-global-infostealer-activity/603547/

#ThreatIntel #CyberThreats #Infostealers #CredentialTheft #DigitalForensics #Malvertising #HudsonRock

Former #1 Movie Piracy Site “Strongly Linked” to Global Infostealer Activity

https://torrentfreak.com/most-popular-movie-piracy-site-ever-strongly-linked-to-global-infostealer-activity-250720/

#infostealers #Fmovies #malware #Piracy

Artikel Cybercrimeinfo: https://www.ccinfo.nl/menu-onderwijs-ontwikkeling/cybercrime/2603946_156-meer-identiteitsdiefstal-hoe-phishing-as-a-service-en-infostealers-mfa-omzeilen-om-je-bankrekening-en-email-te-hacken

Podcast Spotify: https://open.spotify.com/episode/7tY2cjpUfysMeBiKTNkG4l?si=23f0908dcb314e27

Podcast Youtube: https://youtu.be/o0GcyXfFFGA

#identiteitsdiefstal #phishingasaservice #infostealers #cybercrime #Cybersecurity

Shellter Elite, built for ethical hackers, is now abused by cybercriminals after a customer leaked it.

Read: https://hackread.com/leaked-shellter-elite-tool-infostealer-attacks-worldwide/

#CyberSecurity #ShellterElite #CyberCrime #InfoStealers #Malware

Infostealers-as-a-Service Push Identity Hacks to Record Highs https://hackread.com/infostealers-as-a-service-identity-hacks-record-highs/ #IdentityProtection #Cybersecurity #PhishingScam #Infostealers #CyberAttack #Security #Phishing #security #Malware #Privacy

Infostealers-as-a-Service Push Identity Hacks to Record Highs – Source:hackread.com https://ciso2ciso.com/infostealers-as-a-service-push-identity-hacks-to-record-highs-sourcehackread-com/ #1CyberSecurityNewsPost #IdentityProtection #CyberSecurityNews #cybersecurity #Infostealers #PhishingScam #CyberAttack #Hackread #Phishing #security #malware #privacy

Infostealers-as-a-Service and phishing kits push identity hacks to record highs with a 156% jump in login attacks, says new report.

Read: https://hackread.com/infostealers-as-a-service-identity-hacks-record-highs/

#CyberSecurity #Infostealers #Phishing #Malware #CyberAttack

Infostealers blamed for surge in identity attacks #CyberSecurity #Infostealers

https://betanews.com/2025/07/07/infostealers-blamed-for-surge-in-identity-attacks/

When Cybernews published an article about a 16 billion credentials leak, some of us strongly criticized the article as irresponsible and misleading journalism. Although some people have tried to suggest that the Cybernews article had some value in highlighting infostealers, the article was so riddled with falsehoods and misleading statements that the confusion and misunderstandings it created outweighs any benefit one might try to ascribe to it.

To his credit, @JayeLTee and a colleague have taken the time to analyze the datasets used in Cybernews‘ reporting and to fact-check their reporting with actual data and proof from their own research.

He has now written up their findings, in which they identified no less than five significant false claims by Cybernews. You can read his report here:

https://jltee.substack.com/p/fact-checking-claims-by-cybernews

#journalism #dataleak #databreach #infostealers