Stealerium
Stealerium is an open-source .NET/C# information stealer that debuted in 2022 and has been described by its developer as a stealer, clipper, and keylogger. Its codebase was published on GitHub as an "educational tool" and later archived, and multiple reports state that other malware families and forks, including Phantom Stealer/PhantomStealer, were derived from or overlap significantly with the Stealerium codebase. Stealerium is used to steal credentials, browser cookies, session data, cryptocurrency wallet information, and other sensitive data from compromised Windows systems. Reported collection capabilities include browser credential theft, keylogging, clipboard hijacking via a crypto clipper, screenshots, and in some variants or configurations webcam capture. Exfiltration has been observed through multiple channels, especially Discord webhooks, and reporting also notes FTP, SMTP, Telegram, and related code paths in Stealerium-family forks. Proofpoint reported that Stealerium can be configured to monitor open browser tabs for NSFW keywords such as "sex" or "porn" and, when triggered, capture a desktop screenshot and a webcam image, enabling sextortion-oriented abuse. Recent reporting also states that newer Stealerium modules were added specifically for sextrortion. Delivery observed in the provided content includes phishing campaigns and ClickFix-style social engineering chains, including a malicious SVG that triggered a PowerShell ClickFix infection flow to install Stealerium. The malware has appeared in multilingual phishing campaigns, including Italian-language campaigns, and has been used as commodity malware alongside tools such as Remcos RAT, StormKitty, and ZZ Stealer. High-confidence aliases and related naming in the content include Stealerium and the similar name "Stealrium."
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The expanded toolkit in this phase incorporated commodity tools such as Remcos RAT, Stealerium, StormKitty, and ZZ Stealer...
... delivering an open-source information stealer called Stealerium (or variants of it).
... delivering an open-source information stealer called Stealerium (or variants of it).
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Credential Access
2 techniques
Credential Access
According to Trellix's data, various malware families, including Agent Tesla, UmbralStealer, Stealerium, and zgRAT, have also used Discord webhooks over the past few years to steal sensitive information like credentials, browser cookies, and cryptocurrency wallets from compromised devices.
According to Trellix's data, various malware families, including Agent Tesla, UmbralStealer, Stealerium, and zgRAT, have also used Discord webhooks over the past few years to steal sensitive information like credentials, browser cookies, and cryptocurrency wallets from compromised devices.
Collection
1 technique
Collection
Exfiltration
2 techniques
Exfiltration
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Open-source .NET infostealer project that served as the codebase/foundation for Phantom Stealer. It appears to be a simpler precursor without the larger embedded SQLite and BouncyCastle components described for Phantom Stealer.
Referenced as the malware family lineage from which PhantomStealer derives. It provides a modular collector-plus-exfiltration architecture inherited by PhantomStealer.
Commodity stealer used alongside Infy’s proprietary malware.
Open-source .NET infostealer delivered after a ClickFix flow initiated by phishing with a malicious SVG inside a password-protected ZIP, leading the victim to run a PowerShell command.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.