Fickle Stealer
Fickle Stealer is a Rust-based information stealer observed by FortiGuard Labs in May 2024 and targeting Microsoft Windows systems. Fortinet described it as using multiple delivery methods and a flexible, server-driven targeting model, which led researchers to name it "Fickle Stealer." Reported delivery vectors include malicious Word documents with VBA macros, link downloaders, and a .NET executable masquerading as a PDF viewer. Associated PowerShell stages such as u.ps1/bypass.ps1 were used to bypass UAC, establish persistence via scheduled tasks, and prepare execution. Fortinet reported that the malware uses a disguised packer, in-memory payload decryption and execution, anti-analysis and anti-VM checks, and Telegram bot reporting of victim status. Its theft capabilities include browser data, cookies, credentials, LevelDB data from Discord and Chromium-based browsers, password-manager extensions, cryptocurrency wallet data, targeted documents, application data including Steam, Telegram, Signal, Skype, and FileZilla, plus screenshots and system information.
Fickle Stealer is repeatedly associated in the provided reporting with the threat actor EncryptHub, also tracked as LARVA-208 and Water Gamayun. Trustwave reported EncryptHub delivering Fickle Stealer through PowerShell after social-engineering lures and exploitation of the Microsoft Management Console vulnerability CVE-2025-26633 ("MSC EvilTwin"). In that activity, PowerShell scripts established persistence, communicated with EncryptHub C2 infrastructure, received AES-encrypted commands, and deployed Fickle Stealer as a PowerShell-based information stealer designed to extract sensitive files, harvest system information, and steal cryptocurrency wallet data. PRODAFT also reported EncryptHub using PowerShell scripts to deliver Fickle Stealer alongside Rhadamanthys and Stealc in broader social-engineering campaigns, including operations that compromised hundreds of organizations.
The malware was also reported in Steam-related distribution cases. In the Chemia game compromise, Prodaft and other reporting stated that EncryptHub added Fickle Stealer via cclib.dll, which used worker.ps1 to fetch the payload from soft-gets[.]com. In that context, Fickle Stealer was described as stealing browser credentials, autofill data, cookies, and cryptocurrency wallet data, while running in the background without affecting gameplay. Separate reporting on malicious Steam titles also described Fickle Stealer as stealing credentials, browser data, cookies, and cryptocurrency wallets. Additional lures included fake AI or meeting platforms targeting Web3 developers, where malware disguised as a Realtek HD Audio Driver executed PowerShell to retrieve and deploy Fickle Stealer for theft of cryptocurrency wallets, development credentials, and sensitive project data.
High-confidence indicators mentioned in the content include infrastructure and artifacts associated with campaigns delivering or involving Fickle Stealer: IPs 144.208.127.230, 185.213.208.245, and 138.124.184.210; GitHub URL hxxps://github[.]com/SkorikJR; domains soft-gets[.]com, reaitek[.]com, and safesurf.fastdomain-uoemathhvq.workers[.]dev; and hashes including a reported Fickle Stealer sample 6fb7fd9763d6b269793c80bbc03a1be358390781af4b698fba1591cb8dbb8825 and a related downloader hash ed076c27b420bfa66c251488b4121913fa461367a60c5fa32cee3953efcae32b.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The script ... communicates with an EncryptHub command-and-control (C2) server to receive and run malicious payloads, including a stealer called Fickle Stealer. | Trustwave SpiderLabs said it recently observed an EncryptHub campaign that brings together social engineering and the exploitation of a vulnerability in the Microsoft Management Console (MMC) framework (CVE-2025-26633, aka MSC EvilTwin) to trigger the infection routine via a rogue Microsoft Console (MSC) file.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Clicking the message leads to the download of malicious software disguised as a genuine Realtek HD Audio Driver, which executes PowerShell commands to retrieve and deploy the Fickle Stealer.
Techniques & procedures
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
6 techniquesQuery string: SELECT Name FROM Win32_Process
Additionally, it creates a new task that executes engine.ps1 after 15 minutes.
For the most part, they download a PowerShell script for preparatory work. The file name is u.ps1 or bypass.ps1—they indicate the same file.
This attack chain starts with a Word document. Its VBA macro loads an XML file stored in the caption of a UserForm object and executes a script encoded with Windows Script Encoder in the XML file.
After downloading the verified Steam game, the streamer reported losing more than $32,000 from his cryptocurrency wallet.
When the victim enables active content and macro, it reads the MSHTML file and extracts the command from the file.
Persistence
1 techniquePrivilege Escalation
3 techniquesAdditionally, it creates a new task that executes engine.ps1 after 15 minutes.
When a file is found, it runs inject.ps1 to inject shell code, which simply executes u.ps1 from the internet.
The primary purpose of this script is to bypass User Account Control (UAC) and execute Fickle Stealer.
Stealth
8 techniquesIts VBA macro loads an XML file stored in the caption of a UserForm object and executes a script encoded with Windows Script Encoder in the XML file.
The executable downloader is a DotNet executable mimicking a PDF viewer.
When a file is found, it runs inject.ps1 to inject shell code, which simply executes u.ps1 from the internet.
Finally, it sends a screenshot to the server and deletes itself by executing the following command: cmd.exe /c timeout /t 5 & del /f /q {stealer} && exit
Initially, Fickle Stealer creates a mutex to prevent a race condition.
It then performs a series of anti-analysis checks and exits the process while it is being analyzed.
The packer only allocates memory to write the decrypted payload data and then executes it in memory.
Credential Access
3 techniquesThe questionnaire indicates that the FBI is focused on cryptocurrency theft and account hijacks after the installation of the malware, asking questions about cryptocurrency transactions, compromised accounts, and stolen funds.
If found, it copies the file to the Temp folder, sends a copy to the server, and deletes the copy.
It parses data in Cookies, History, WebData, and Login Data files to obtain sensitive data and sends a summarized result to the server.
Discovery
3 techniquesBesides the message, tgmes.ps1 sends victim information, including country, city, IP address, OS version, computer name, and user name to the Telegram bot.
Collection
3 techniquesFickle Stealer sends all files in folders according to the list.
After being compressed with the Deflate algorithm, the JSON-formatted data is sent to the server.
Command and Control
2 techniquesThe web page contains a script that configures exclusions for Fickle Stealer and then downloads it to be executed.
Exfiltration
1 techniqueAfter being compressed with the Deflate algorithm, the JSON-formatted data is sent to the server.
IOCs tracked for this family
60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Stealer malware referenced in relation to a detection for malicious MSC file creation in a mock trusted Windows directory.
A custom information stealer that steals credentials, browser data, cookies, and cryptocurrency wallets.
Information stealer delivered in campaigns exploiting Windows MMC vulnerability CVE-2025-26633 (MSC EvilTwin) and via fake AI platforms targeting Web3 developers (per summaries).
Information-stealing payload delivered as a secondary stage via PowerShell, received from EncryptHub C2 and executed on infected hosts.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.