Masslogger

MassLogger is a Windows-based .NET credential-stealing malware family commonly described as an infostealer and, in some campaigns, a keylogger-capable spyware trojan. Active since at least 2020 and sold on underground forums, it is frequently used in commodity cybercrime operations focused on harvesting credentials and other user data from browsers, email clients, messaging applications, VPN software, FTP clients, and related desktop applications. Reported targets include Chromium-based browsers, Firefox-derived browsers, Microsoft Outlook, Thunderbird, FoxMail, FileZilla, Discord, NordVPN, and other commonly used client software.

Its core functionality centers on credential theft and data exfiltration. Documented variants can capture browser-stored login data, collect clipboard contents, and exfiltrate stolen information over protocols including FTP, SMTP, and HTTP-based panels. MassLogger also has keylogging capability, although some observed campaigns disabled that feature in configuration. Additional reporting indicates some variants have implemented Discord token theft. In-memory execution and reflective loading have been observed in multiple campaigns, including loaders that reconstruct and execute .NET assemblies in memory and inject the final payload into legitimate Windows processes such as msbuild.exe to reduce detection.

MassLogger is commonly delivered through phishing and malspam campaigns using business-themed lures such as invoices, quotations, and financial documents. Observed delivery chains include password-protected archives, multi-volume compressed attachments, compiled HTML Help files, Visual Basic Encoded scripts, and archive-contained executables. PowerShell-heavy, largely fileless chains have also been documented, with obfuscated scripts downloading or reconstructing later stages in memory. The malware is additionally distributed by third-party loaders and malware delivery services, including QuirkyLoader, and has appeared alongside other commodity malware families such as Agent Tesla, AsyncRAT, Formbook, Remcos, Rhadamanthys, Snake Keylogger, XWorm, RedLine, and Phantom Stealer, indicating shared delivery infrastructure and loader-as-a-service style operations.

MassLogger primarily targets Windows environments and is prevalent in broad financially motivated campaigns rather than tightly scoped espionage operations. Geographic targeting in observed campaigns has included multiple European countries, and invoice- or tax-themed lures have also been used against organizations in other regions. Its continued use reflects the enduring effectiveness of low-cost credential theft malware combined with evasive, memory-resident loaders and socially engineered email delivery.