Research reports
1,224 reports from 387 publishers45 added in the past week
5 reports, newest added first
Added Sun 25 Oct
Vidar v1.5 in Go: same family, new language, heavy sandbox checks
Vidar is a name most infostealer trackers know well -- an Arkei descendant that has been snatching browser credentials and crypto wallets since 2018. It usually ships as a .NET binary or a C++ PE. The v1.5 sample we pulled from Triage on May 13, 2026 is…
Infostealers
StealC Is Back, and This Time It's a RAT
In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…
MalwareInfostealersTakedowns and arrests
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…
MalwareInfostealersMobile
Added Sat 24 Oct
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest…
Infostealers
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
We’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now has a second stage that persists even if the victim has removed the malicious workflow. Existing Stage 1: Use stolen GitHub…
Infostealers
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.