Loading malware…
Rhadamanthys is a Windows information stealer used to collect and exfiltrate browser credentials, session information, cryptocurrency-wallet data, KeePass-related credentials, and information about compromised computers. Theft of browser session data can enable account takeover without requiring an attacker to authenticate using the victim’s password.
Rhadamanthys is distributed through multiple infection chains, including phishing, deceptive software-download sites, fake Windows update prompts, and ClickFix social engineering. The JackFix campaign has delivered it through counterfeit adult websites promoted through malicious advertising. Meowsterio has deployed it through deceptive landing pages and Windows ClickOnce applications. Other distribution activity has used links in comments on gaming-related YouTube videos. Delivery frameworks observed deploying Rhadamanthys include GHOSTPULSE, Matanbuchus, and maliciously used Shellter-protected executables.
Document-themed delivery includes malicious Microsoft Management Console files disguised as Word documents. These abuse legitimate Console Taskpad functionality to retrieve and execute a PowerShell script containing the stealer, rather than exploiting CVE-2024-43572. Separate phishing campaigns have exploited WinRAR vulnerability CVE-2023-38831 to execute Rhadamanthys from specially crafted archives. Sandworm, associated with Russia’s GRU Unit 74455, used this technique in invitation-themed emails impersonating a Ukrainian drone warfare training school. Rhadamanthys is therefore used in both financially motivated malware distribution and targeted state-linked operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2023-38831, the WinRAR zero-day remote code execution vulnerability, has been exploited in the wild to distribute several malware families.
Threat Details and IOCs Malware: ... Rhadamanthys ...
16 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Meowsterio relies on infostealers such as StealC and Rhadamanthys to steal victim computer information and cryptocurrencies wallets data.
Rhadamanthys is an infostealer malware which has the capability to collect and exfiltrate browser credentials and session information.
In this campaign, WasabiSeed is utilised to drop a number of files, ending with the Rhadamanthys Information Stealer.
Check Point Research is tracking an ongoing, large scale and sophisticated phishing campaign deploying the newest version of the Rhadamanthys stealer (0.7).
Recorded future unveiled in June 2024 that Atomic stealer is likely spread by the alias ‘markopolo’, an IAB spreading StealC, Rhadamanthys and Atomic
It is claimed that the Rhadamanthys Stealer is used and a loader for Traffers is provided.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
These fake CAPTCHAs arrive via phishing emails, URL redirection or malvertisement, or SEO poisoning.
Users encounter a CAPTCHA page that mimics a legitimate human verification prompt, often while browsing seemingly harmless content websites.
These tactics range from using phishing emails containing malicious ZIP files to deploying different families of malware.
In some cases, the phishing emails attach a PDF instead of including a direct link. Once opened, the PDF redirects the user to a fake CAPTCHA landing page.
Upon exploiting the successful vulnerability, it leads to BAT file execution, which pretends to be a PDF file.
The script then uses Microsoft HTML Application Host (mshta) or base64-encoded PowerShell to execute a highly obfuscated command, which, in turn, connects to another site and executes multistage encoded scripts directly to the memory.
When a victim double-clicks on the PDF, the vulnerability will quietly launch a script in the folder to install malware on the device.
AI-Themed Brand Abuse A third category uses AI branding without meaningful AI integration. Filenames reference popular AI companies or other AI products, but the payload is conventional malware wrapped in an installer that mimics an AI application. The AI branding is a social engineering tactic, not a technical capability.
When lyricalsync.mp3 is executed via mshta, it initiates a multistage deobfuscation process designed to evade detection mechanisms.
SHELLTER-protected samples commonly employ self-modifying shellcode with polymorphic obfuscation... legitimate instructions and polymorphic code helps these files evade static detection and signatures.
The function denoted as parse_response is responsible for decoding the next stage that was downloaded from the C2 and hidden in a media file (JPG).
VM obfuscator. Heavy VM and sandbox detection capabilities... Zscaler investigators found that the VM obfuscator used is the Quake 3 VM.
A third group uses AI branding purely as bait, dressing up an ordinary payload as installers for well-known AI products... The single most widely encountered sample was an installer posing as a recipe-finding app called Recipe Lister... Oyster backdoor, posed as a Dropbox installer.
0: Decode shellcode received as an argument... 3: Decrypt stage 2 using an algorithm of the TEA family
The script then uses Microsoft HTML Application Host (mshta) or base64-encoded PowerShell to execute a highly obfuscated command.
The report identifies a C++ loader client abusing BITS for C2 and lists LUMMA, ARECHCLIENT2, and RHADAMANTHYS command-and-control infrastructure.
The URL used to contact the C2 is obtained from the config. It is used to fetch Stage 3
1,361 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as another malware operation affected by the November 2025 Operation Endgame disruption. Its capabilities are not described.
Mentioned only as an example of a malware name drawn from Greek mythology; no capabilities or campaign details are provided.
Information stealer named among the malware associated with a campaign using likely ClickFix initial access, trusted services, blockchain-hosted payloads and C2 configuration, and DGA domains. No Rhadamanthys-specific execution details are provided.
Mentioned solely as a possible antivirus verdict label; the analysis identifies the analyzed payload as Vidar-class rather than Rhadamanthys.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.