XillenStealer: New Open-Source Malware Lowers Cybercrime Barrier

XillenStealer is described as an open-source, Python-based information stealer publicly available on GitHub, with its core features including harvesting host identifiers, hardware specifications, browser credentials, cryptocurrency wallets, and network configurations, while also taking screenshots for added intelligence gathering. Publicly available on GitHub, the malware is rapidly becoming a tool of choice for both novice and experienced threat actors, according to CYFIRMA.

Its built-in builder, XillenStealer Builder V3.0, is a Python-based Tkinter GUI that enables operators to configure, compile, and manage customised stealer builds, and lowers technical barriers by allowing attackers to toggle modules for Discord, Steam, Telegram and crypto wallets, set up Telegram-based data exfiltration, and compile executables with PyInstaller and UPX, while applying anti-debugging and VM-detection safeguards.

The malware targets credentials from Chromium- and Firefox-based browsers and cryptocurrency wallets such as Exodus, AtomicWallet and Electrum, and can hijack accounts via theft of Discord tokens, Steam credentials, and Telegram sessions, with data transmitted via a Telegram bot alongside a report.txt and a report.html.

The infrastructure behind XillenStealer appears linked to Russian-speaking groups, with CYFIRMA attributing it to a group branding themselves as Xillen Killers, and noting the persona of the alleged developer: BengaminButton, described as a 15-year-old full‑stack developer and penetration tester.

According to CYFIRMA, the tool’s modular design and low barrier to entry represent a significant escalation in the professionalisation of cybercrime, and its GitHub availability highlights tensions between openness and weaponisation of code.