Research reports
1,224 reports from 387 publishers45 added in the past week
55 reports, newest added first
Added Sun 25 Oct
Vidar v1.5 in Go: same family, new language, heavy sandbox checks
Vidar is a name most infostealer trackers know well -- an Arkei descendant that has been snatching browser credentials and crypto wallets since 2018. It usually ships as a .NET binary or a C++ PE. The v1.5 sample we pulled from Triage on May 13, 2026 is…
Infostealers
StealC Is Back, and This Time It's a RAT
In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…
MalwareInfostealersTakedowns and arrests
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…
MalwareInfostealersMobile
Added Sat 24 Oct
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest…
Infostealers
GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
We’ve discovered a new element to the GhostAction campaign, which steals secrets through malicious GitHub Actions workflows. It now has a second stage that persists even if the victim has removed the malicious workflow. Existing Stage 1: Use stolen GitHub…
Infostealers
Added Mon 19 Oct
Added Sun 18 Oct
GitHub - FallenAstaroth/stink: the cutest python-native infostealer
No excerpt available.
Infostealers
Added Fri 16 Oct
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data
Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in…
MalwareInfostealers
Added Wed 14 Oct
Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication
LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, we…
MalwareInfostealers
Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation
In April 2026, Unit 42 researchers identified a financially motivated campaign delivering Vidar stealer and the XMRig cryptocurrency miner to consumer and small- and medium-sized business victims worldwide. Attackers lure victims via malvertising to pages for…
MalwareInfostealers
Added Thu 8 Oct
$100k in Crypto Drained by the Underground Operation
Netskope Threat Labs analyzed a crypto-stealing operation that drains victims’ cryptocurrency exchange accounts. An Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the…
MalwareInfostealers
Added Wed 23 Sep
Vidar Virtual Machine-Based String Obfuscation
The following sections examine Vidar’s string deobfuscation process, including a lightweight virtual machine and custom stream cipher. Virtual machine deobfuscation In order to obfuscate the malware’s strings in versions 2.x and 3.x, the Vidar developer…
Infostealers
Added Thu 17 Sep
StealC-Malware-Analysis/Reports/StealC-V2-EN.md at main · Yavuzhanzgen/StealC-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. StealC V2 Malware Technical Analysis Static Analysis • Dynamic Analysis •…
MalwareInfostealers
Added Tue 8 Sep
Amatera Stealer 4.0.2 Beta: What's New in This Variant
What did we find? In late April 2026, eSentire's Threat Response Unit (TRU) intercepted an attempted delivery of Amatera Stealer within a customer environment in the Finance industry. Amatera Stealer is a rebranded version of ACR (AcridRain) Stealer, a C++…
Infostealers
ACR Stealer: Two observed intrusion chains amid increased threat activity
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments. These campaigns are successfully using ClickFix lures to steal browser credentials, authentication tokens, and sensitive…
Infostealers
WordlistLoader Delivering Amatera via ClearFake Campaigns
Gen Threat Labs has identified WordlistLoader, a new loader used to deliver Amatera Stealer via ClearFake campaigns. Amatera has been actively developed over the past few months and has gradually become one of the most prevalent infostealers in our user base.…
Infostealers
Added Fri 14 Aug
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
Elastic Security Labs is tracking an emerging threat named TELEPUZ, which we have discovered spreading widely via a CLICKFIX-VIDAR chain. This malware is in active development and has been operating since late April 2026, according to the infrastructure…
MalwareInfostealers
Added Tue 4 Aug
Added Tue 28 Jul
ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 2
In Part 1, I walked through the full delivery chain, from the ClickFix lure through the MSI package, both loader stages, and into the ti64 orchestrator. By the end, the syscall table was built, ntdll was unhooked, and TinyCallProxy64 was loaded into the…
Infostealers
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.