Rhadamanthys Stealer Offered on Dark Web for $299–$499

Rhadamanthys, described as a sophisticated information stealer, has appeared on underground marketplaces with subscription packages ranging from $299 to $499 per month.

The offering is marketed in three core tiers: Self-Hosted at $299 per month, allowing buyers to deploy the stealer on their own infrastructure; a mid-tier Managed Server at $499 per month that provides rented servers with automated updates and priority support; and an Enterprise option available via individual negotiations for bespoke features and SLAs.

Since its debut in September 2022 under the alias kingcrete2022, Rhadamanthys has evolved into one of the most feature-rich stealers on the dark web, transitioning from an experimental project to a professional software-as-a-service style operation with a Tor storefront, Telegram channels, and branding such as RHAD Security and Mythical Origin Labs.

The latest iteration embeds encrypted modules directly in PNG images, replaces earlier PE structures with custom formats, and uses ChaCha20 for configuration encryption while supporting multiple C2 URLs and LZO compression. In use, it collects credentials, cookies, browser fingerprints, cryptocurrency wallet data, VPN configurations and even supports Lua plugins for broader software coverage. October 3, 2025.