ANY.RUNPublished
MicroStealer Analysis: A Fast-Spreading Infostealer with Limited Detection
By nevergiveupcpp, 4OURUP and GridGuardGhoul
Excerpt
Security teams depend on early signals to spot and contain new threats. But what happens when a fully capable infostealer spreads while traditional detections stay limited?
In recent investigations, ANY.RUN researchers observed MicroStealer in 40+ sandbox sessions in less than a month, despite low public visibility. Early activity points to distribution through compromised or impersonated accounts, with education and telecommunications among the affected sectors.
MicroStealer is more than just another stealer. It targets browser credentials, session data, screenshots, and wallet files while using a layer…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ANY.RUN on any.run.
More from ANY.RUN4
- SnappyClientANY.RUN · Added 22 Jul
- LATAM Businesses Hit by XWorm via Fake Financial Receipts: Full Campaign AnalysisANY.RUN · Published 17 Feb
- LATAM Under Siege: Agent Tesla’s 18-Month Credential Theft Campaign Against Chilean EnterprisesANY.RUN · Published 14 May
- When Trust Becomes a Weapon: Google Cloud Storage Phishing Deploying Remcos RATANY.RUN · Published 14 Apr
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
