Stealerium: How an Open-Source Infostealer Is Being Used in Phishing Campaigns

Proofpoint threat researchers have flagged a surge in campaigns distributing Stealerium, an open-source infostealer first released on GitHub in 2022 “for educational purposes,” now being adopted and modified for real-world attacks. According to Proofpoint, Stealerium’s open availability accelerates its use, with several variants such as Phantom Stealer and Warp Stealer grouped under the Stealerium family.

Telemetry shows Stealerium returning to the threat landscape in mid-2025, including a May 2025 campaign impersonating a Canadian charitable organisation, a late May campaign from a low-sophistication actor, a 23 June 2025 travel-themed lure targeting hospitality, education and finance, and a 24 June 2025 global campaign with a fake “Xerox Scan” payment lure that also harvested Wi-Fi profiles.

By 2 July 2025, legal-themed emails with IMG files and embedded VBScript payloads delivered Stealerium, while message volumes ranged from a few hundred to tens of thousands. Stealerium is written in .NET and offers credential theft, system reconnaissance, crypto theft, a sextortion feature and various persistence and anti-analysis methods, with exfiltration options including SMTP, Discord Webhooks, Telegram, GoFile and Zulip Chat.