Loading malware…
Meduza is a Windows information-stealing malware family operated in the Russian-language cybercrime ecosystem since at least 2023. It is commonly classified as an infostealer and has been associated with theft of browser-stored credentials and other sensitive user data. Public reporting also links Meduza to theft of cookies and session material, cryptocurrency wallet data, messaging-application data, email and VPN-related information, screenshots, and host profiling data. Meduza has been observed abusing Windows credential-access functionality, including the Windows Credential Vault, and has been cited among stealers capable of bypassing Chrome App-Bound Encryption protections.
The malware has appeared in financially motivated intrusion activity and has been linked to abuse-resistant hosting infrastructure used to support stealer operations. Aeza Group, a Russia-based bulletproof hosting provider later sanctioned by the United States, was publicly linked to infrastructure supporting Meduza operations, alongside other infostealers and ransomware actors. Meduza has also been referenced in downstream criminal delivery chains where access brokers or RAT operators attempted to deploy stealers after initial compromise.
Observed delivery contexts include phishing-driven campaigns and secondary deployment from remote administration malware. Meduza was specifically noted as a follow-on payload in campaigns using NetSupport RAT, indicating its use both as a standalone stealer and as a monetization payload after initial access is established. Spanish-language phishing telemetry has also placed Meduza among malware families delivered through embedded malicious URLs.
Russian authorities have publicly announced arrests of suspects accused of developing, distributing, and selling Meduza, and linked the malware to at least one intrusion against a government organization in Astrakhan region. Reporting describes the operators as also developing additional malware intended to disable security tools and support botnet activity, underscoring Meduza’s placement within a broader criminal tooling ecosystem.
Meduza primarily targets Windows systems and is relevant to enterprises, government entities, technology organizations, and other sectors exposed to credential theft and follow-on fraud or intrusion activity. Its role in stealing credentials, session data, wallet information, and other host-resident secrets makes it a common precursor to account compromise, financial theft, and broader post-compromise exploitation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The VaultCLI.dll module allows processes to extract credentials from the Windows Credential Vault. It was seen being abused by information stealers such as Meduza.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Collection Atomic, Vidar, Meduza, Raccoon, Snaffler, Hekatomb, Lumma, DBeaver, MongoDB Compass, Azure SQL Query Editor, Cerebrata, FiveTran, Ave-Maria
In a number of cases, we observed attempts to use NetSupport RAT to install stealers such as Rhadamanthys and Meduza.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Russian police arrested “three young IT specialists” suspected of developing and selling the Meduza credential-harvesting malware.
Browser data: Credentials, cookies, histories, bookmarks, autofill data, and more, with support for more than 100 browsers
According to researchers at Hudson Rock, Meduza was highly equipped with tools to scoop up a wealth of data, including: Authentication: Targeted popular password managers and 2FA extensions
Authentication: Targeted popular password managers and 2FA extensions
152 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information stealer cited as using Aeza Group hosting infrastructure.
Infostealer malware whose operators were supported by Aeza Group hosting infrastructure, according to the content.
Referenced as a known stealer whose theft target list is similar to the malware under analysis. No direct operational details beyond similarity are provided in the content.
A named infostealer listed in the RAMP malware marketplace.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.