Loading threat actor…
SolarMarker is a modular malware operation and associated threat actor ecosystem active from at least 2020 until its infrastructure went defunct in 2024. The malware is also tracked as Yellow Cockatoo, Jupyter, and Polazert. It has been characterized not merely as an infostealer, but as an operator-driven fraud platform in which a developer and affiliates used persistent access to victim systems to conduct hands-on financial fraud from the victim device itself. SolarMarker commonly targeted business professionals through SEO poisoning and search-result manipulation. The operators created large volumes of keyword-stuffed lure pages for business forms and templates, then redirected victims to downloads masquerading as documents while installing the malware alongside legitimate decoy applications. This tradecraft relied on social engineering and user execution rather than software exploitation. The malware family is modular and has included an infostealer, backdoor, keylogger, VNC component, form-grabber and cryptocurrency-wallet theft functionality, and a SOCKS proxy. The backdoor provided persistence and delivered follow-on components, while the VNC capability enabled remote interactive access. Operators used the victim’s own browser environment, stored credentials, and active authenticated sessions to access webmail, e-commerce, banking, and cryptocurrency accounts directly from the compromised host. Observed activity included reviewing stored payment data, extracting financial information from email, making purchases, creating and later removing inbox rules to conceal transaction messages, and deleting evidence from the browser and mailbox. SolarMarker operators also demonstrated defense evasion and post-exploitation tradecraft. They injected the VNC payload into legitimate Windows processes, used PowerShell in the persistence chain, copied Chromium user data into a temporary profile for attacker-controlled browsing, and manually cleared browser history to reduce forensic visibility. The actor consistently signed first-stage payloads and extensively abused Authenticode certificates, with evidence indicating many certificates were obtained through impostor identities rather than stolen from legitimate organizations. Certificate reuse overlapped with other malware families, suggesting shared third-party signing services or broader criminal certificate abuse ecosystems. SolarMarker activity has also been linked by technical overlap to ERYTHRITE, an activity cluster reported in industrial intrusion reporting. In that context, SEO poisoning and credential-stealing malware associated with ERYTHRITE were reported against organizations in the United States and Canada, including a compromise that reached access into an OT environment. SolarMarker’s dominant motivation is financial gain, particularly fraud and theft conducted through victim-resident sessions and account access.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting on-device financial fraud and data theft by using a VNC-capable malware platform to access victims’ browser sessions, email, banking, Amazon, Gmail, and Coinbase accounts directly from infected devices.
A malware actor studied for its repeated use of valid Authenticode certificates to sign first-stage payloads, with certificate reuse linking it to other malware families through shared signing services/impostors.
A financially motivated threat group distributing the SolarMarker RAT via SEO poisoning and Google Sites lure pages offering fake business document templates, then using decoy applications like Slim PDF to mask infection and establish footholds for follow-on fraud, credential theft, banking trojans, ransomware, or espionage/exfiltration.
SolarMarker is an information-stealing malware operation with a sophisticated, multi-tiered infrastructure, targeting data from web browsers and cryptocurrency wallets, and continuously evolving to evade takedowns.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.