Excerpt
Netskope Threat Labs analyzed a crypto-stealing operation that drains victims’ cryptocurrency exchange accounts. An Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the pages the victim opens.
The operation is built with a malware builder whose loader telemetry records date back to October 2023. We refer to the builder as Underground, after the folder its loader logs to ( C:\ProgramData\Underground\ ). For this operator, we mapped seven gate domains, 80+ destination addresses across about…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Netskope on netskope.com.
More from Netskope3
- OpenClaw’s Hologram: Fake Installer Ships Rust InfostealerNetskope · Published 7 May
- Shai-Hulud 2.0: Aggressive, Automated, and Fast SpreadingNetskope · Published 26 Nov 2025
- New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)Netskope · Published 10 Aug 2021
On the same topics
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataGen Digital · Published 8 Oct
- Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control CommunicationLevelBlue · Published 7 May
