Python-Based “XillenStealer” Campaign Targets Windows Users’ Sensitive Data

A Python-based information stealer named XillenStealer has emerged as a significant threat to Windows users, designed to harvest sensitive system data, browser credentials and cryptocurrency wallet information. It operates through a builder framework called “XillenStealer Builder V3.0,” featuring a Python-based Tkinter GUI that lets threat actors configure attacks with minimal technical expertise and includes password authentication via SHA-256 validation, plus Telegram bot integration for exfiltration.

The malware’s modular design targets a range of applications and services, including Discord, Steam, cryptocurrency wallets, Telegram sessions and gaming launchers, with data exfiltration conducted through Telegram and reports delivered in HTML and text formats. Security researchers at Cyfirma have identified this open-source malware as publicly available on GitHub, making it accessible to cybercriminals of varying skill levels.

The open-source availability lowers the barrier to entry, and the threat actor behind BengaminButton claims to be a 15-year-old full-stack developer, operating a central forum at xillenkillers[.]ru and offering tools including DDoS platforms and exploitation frameworks.