Loading malware…
SolyxImmortal is a Python-based information stealer targeting Windows systems, identified in January 2026. It combines browser credential theft, cookie collection, document harvesting, keylogging, and screenshot surveillance in a continuously running, multithreaded implant. It operates in the current user's context without requiring administrative privileges and emphasizes persistent surveillance rather than destructive activity.
The malware steals saved credentials from Chromium-based browsers, including Chrome, Edge, Brave, and Opera GX, using Windows DPAPI to recover browser encryption keys and AES-GCM to decrypt stored passwords. It also copies Firefox cookie databases and searches the user's home directory for text files, Office documents, and PDFs, applying file-size limits. Keystrokes are buffered and transmitted periodically. Screenshots are captured at regular intervals and when foreground window titles match keywords associated with authentication, banking, or account access. Its screenshot logic includes Turkish-language keywords.
SolyxImmortal establishes persistence through a per-user logon autorun entry and a hidden copy disguised as a legitimate Windows component. Collected files are staged and compressed into ZIP archives, then exfiltrated through attacker-controlled Discord webhooks over HTTPS. Separate webhooks support file and log delivery and screenshot transmission, with operator notifications for selected events. Temporary staging artifacts are deleted after successful exfiltration. The malware has circulated through underground Telegram channels associated with commodity malware distribution; no specific threat actor attribution is established.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Training users to spot phishing emails and suspicious attachments remains one of the most reliable defenses against malware that depends on user interaction to gain its initial foothold.
This malware is implemented as a monolithic Python application intended to be packaged and executed on Windows systems.
When the Python script is executed, the entry function calls the start function.
By registering itself under the user’s Run key, the malware ensures execution upon each user logon without requiring administrative privileges.
By registering itself under the user’s Run key, the malware ensures execution upon each user logon without requiring administrative privileges.
All harvested data is staged locally, consolidated into a compressed ZIP archive, and exfiltrated to an attacker-controlled Discord server via hardcoded webhook endpoints using HTTPS POST requests.
It saves itself as win_gfx_driver.exe and sets its file attributes to hidden and system... The registry key it creates, named WindowsGfxDriver, sounds like a legitimate Windows component.
It saves itself as win_gfx_driver.exe and sets its file attributes to hidden and system, making it invisible during standard file browsing.
The script starts by adding persistence by copying itself to the APPDATA folder and modifying the Run registry to execute the script from %APPDATA%\WindowsGraphics wherever the user logs in.
A persistent keyboard hook is established early during execution.
Beyond passwords, the malware also grabs Firefox cookies by copying the browser’s cookie database directly to a staging folder.
Credential Access T1552.001 Unsecured Credentials: Credentials in Files
It pulls saved passwords from Chromium-based browsers such as Chrome, Edge, Brave, and OperaGX by reading their local databases and decrypting stored credentials using AES decryption.
Saved login entries are retrieved directly from browser SQLite databases and decrypted using AES-GCM.
The malware recursively enumerates the user’s home directory to locate documents of interest.
It then walks the user’s home directory looking for documents in .txt, .pdf, .docx, and .xlsx formats.
A persistent keyboard hook is established early during execution.
Screenshot files were written to disk and exfiltrated via a dedicated Discord webhook, with priority handling observed when activity related to authentication or financial services was detected.
Files between 100 bytes and 10 MB are copied and bundled into a zip archive named Solyx_Final_Data.zip before being uploaded to Discord.
Before exfiltrating the staged data, the staging folder is compressed and saved in the TEMP folder as Solyx_Final_Data.zip.
If a file is specified, it is sent as part of the POST request; otherwise, the content is sent as a JSON blob.
Two distinct Discord webhooks are used: one dedicated to structured data exfiltration (credentials, archives, logs) and another reserved for screenshot transmission.
All data exfiltration is performed via HTTPS POST requests to Discord webhooks.
The malware leverages Discord webhooks as its data exfiltration channel... Data leaves the infected machine through Discord’s own web API using Python’s requests library, blending malicious traffic with normal web activity.
Public reporting from Cyfirma indicates that the malware exfiltrates data via Discord webhooks.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.