Rhadamanthys Stealer Evolves: Adds Device Fingerprinting, PNG Steganography Payloads

The Hacker News reports that Rhadamanthys Stealer has evolved to include device and web browser fingerprinting and now delivers its payload hidden in steganographic PNG files, as part of its ongoing updates in version 0.9.2. The article notes that the threat actor behind Rhadamanthys has also marketised two other tools, Elysium Proxy Bot and Crypt Service, on their site, while continuing to operate under a malware-as-a-service model.

First advertised by a threat actor named kingcrete2022, Rhadamanthys is described as one of the most popular information stealers in MaaS alongside Lumma, Vidar, StealC and Acreed. Check Point researcher Aleksandra "Hasherezade" Doniec was cited saying that the authors rebranded as "RHAD security" and "Mythical Origin Labs" and that the current version includes obfuscation refinements and new components, including a Lua-based stealer with device and browser fingerprinting capabilities.

The report highlights that the payload can be delivered via WAV, JPEG or PNG, with decryption of the PNG payload requiring a shared secret established during the initial C2 phase, and notes Rhadamanthys’ pricing starts at $299 per month for a self-hosted variant, rising to $499 per month for additional benefits.

According to the article dated 3 October 2025, the sample also contains environment checks to avoid sandboxes and an alert mechanism to prevent leaking unpacked artifacts, continuing to connect to a C2 server only after the checks pass.