‘SolyxImmortal’ Information Stealer Emerges

SolyxImmortal is a newly identified information stealer written in Python that targets Windows systems and runs as a background process, relying on legitimate APIs and third‑party libraries for data harvesting and exfiltration. According to Cyfirma, it can steal credentials from Chrome and other Chromium browsers, enumerate the user’s home directory, collect documents, and store keystrokes in memory before exfiltrating them via HTTPS POST to Discord webhooks.

The malware also captures screenshots and performs routine surveillance by monitoring active windows and sending images to a dedicated Discord webhook, with hardcoded command‑and‑control parameters and a hardcoded Discord user ID for immediate notifications. It copies itself into the user’s AppData directory, hides the executable, and registers under Run to execute at logon, while eschewing self‑propagation.

Cyfirma notes that SolyxImmortal is likely intended for low‑to‑medium sophistication threat actors and appears to have been developed by a Turkish‑speaking actor, with the sample described as opportunistic data theft and surveillance. The analysis was published on 19 January 2026. according to Cyfirma.