Research reports
1,224 reports from 387 publishers45 added in the past week
48 reports, newest added first
Added Tue 28 Jul
ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 1
While browsing, I randomly came across an ad telling me that human verification was required. Curious, I followed it. The site it led to was simple. Just a lonely button, asking me to click it to prove I was human. Once I did, I was given instructions: press…
Infostealers
Armored Likho's new weapon: BusySnake Stealer
During our routine threat monitoring, we uncovered a new phishing campaign tied to a previously unknown APT group that we dubbed Armored Likho (also known as Eagle Werewolf based on circumstantial evidence). This targeted campaign focuses heavily on…
State-sponsoredInfostealers
Added Thu 23 Jul
Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine
This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 (also tracked by CERT-UA as UAC-0226), delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian…
State-sponsoredInfostealersVulnerabilities
Added Tue 21 Jul
New North Korean campaign uses fake coding interviews to steal developer credentials
Elastic Security Labs found a new Contagious Interview campaign, tracked as REF9403, hiding malware inside SVG image files using steganography. To our knowledge, this specific infection chain has not been previously documented. We found it after the…
Infostealers
Added Sat 18 Jul
Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials
Then Exposes Its Own GitLab Credentials Overview The OX Research team recently discovered a malicious npm package cryptocurrency theft and credential exfiltration campaign. The package specifically impersonates target high-value crypto users. In a new…
MalwareInfostealersSupply chain
Added Thu 9 Jul
Amadey and StealC: Malware-as-a-Service Unavailable
On June 24, 2026, demonstrating the power of public-private collaboration, Europol and the Microsoft Digital Crimes Unit, alongside our team and other global partners, executed a coordinated disruption as part of Operation Endgame, impacting two of the most…
MalwareInfostealers
Added Wed 20 May
OpenClaw’s Hologram: Fake Installer Ships Rust Infostealer
Netskope Threat Labs has found a fake OpenClaw installer delivering red-team-grade capabilities—all pointed at stealing credentials from over 250 crypto wallet and password manager extensions. The dropper’s manifest doesn’t hide the intent: “Hologram – Decoy…
MalwareInfostealers
Added Thu 14 May
From XLoader to Phantom Stealer: A DHL-Themed multi-stage Infection Chain
I have identified a multi-stage malware campaign delivering Phantom Stealer v3.5.0 via a DHL-themed spam email. Initial access occurs through a ZIP attachment masquerading as an invoice and requiring user execution. The archive drops a signed Java utility…
Infostealers
Added Tue 12 May
New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages
The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users. Save to Folio Key Takeaways…
MalwareInfostealers
Added Sat 9 May
MicroStealer Analysis: A Fast-Spreading Infostealer with Limited Detection
Security teams depend on early signals to spot and contain new threats. But what happens when a fully capable infostealer spreads while traditional detections stay limited? In recent investigations, ANY.RUN researchers observed MicroStealer in 40+ sandbox…
Infostealers
Added Thu 7 May
The footprints of Raccoon
In the summer of 2020, Group-IB specialists discovered a malware distribution campaign exploiting Telegram’s legitimate features. Analysis showed that the attackers used the technique to distribute Raccoon stealer, i.e. malware spread through the…
MalwareInfostealers
BYOS – Bundle Your Own Stealer
Check Point Research (CPR) provides an in-depth analysis of the new malware strain dubbed BundleBot spreading under the radar. BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all.…
Infostealers
Added Wed 6 May
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads
Anthropic inadvertently exposed internal Claude Code source material via a misconfigured npm package, which included approximately 512,000 lines of internal TypeScript and triggering rapid mirroring across GitHub. Within 24 hours, threat actors took advantage…
Infostealers
Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
We identified 109 malicious GitHub repositories across 103 accounts that impersonate legitimate projects and redirect users to embedded ZIP files containing a LuaJIT-based SmartLoader stage. The campaign appears to be operated by a single threat actor or…
MalwareInfostealers
Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0
We are in the middle of the next transition. This time, the failures are silent. Modern malware is industrialized: sold as-a-service, rapidly iterated, and designed to scale. At the same time, defenders increasingly depend on automated pipelines. When those…
MalwareInfostealers
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
Special thanks to Greig Bailey for their effort in triaging and responding to this activity, and Aaron Deal for his tireless review and edits of this blog. Summary Information stealers continue to be an initial access vector for severe attacks against…
MalwareInfostealers
Added Tue 5 May
Lumma Stealer
Reading tip: Clicking on the image allows viewing it in full resolution for improved readability. Summary Introduction Lumma Stealer overview Global Threat Record growth Campaigns Persistence Defense evasion Telegram as marketplace for stolen logs First stage…
Infostealers
Approaching stealers devs : a brief interview with Amadey
To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are dominating it. Always remember that behind every user of the Internet there is another human like you, so if you can be…
Infostealers
Added Fri 1 May
Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer…
S2W threat research and intelligence center Talon has hunted for and analyzed a sample of what is believed to be a new malware from the Kimsuky group on VirusTotal. — The malware was found to be distributed from a page that redirects users to a specific site…
State-sponsoredMalwareInfostealers
Added Fri 24 Apr
The Emergence of the New Azorult 3.3
During the past week, Check Point Research spotted a new version of Azorult in the wild being delivered through the RIG exploit kit, as well as other sources. Azorult is a long known information stealer and malware downloader, with this particular version…
MalwareInfostealers
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.