Loading malware…
ZZ Stealer is an infostealer observed in reporting on Iranian threat activity, particularly in correlation with the state-sponsored actor Infy (also known as Prince of Persia). It was described as part of an expanded toolkit that also included commodity malware such as Remcos RAT, Stealerium, and StormKitty. SafeBreach reported a two-stage attack in which ZZ Stealer loads a custom variant of the StormKitty infostealer. Separate reporting also stated that ZZ Stealer was found in a malicious package targeting the Python Package Index (PyPI), and SafeBreach noted similarities between this activity and a 2024 open-source Python library compromise documented by Checkmarx. High-confidence details in the provided content do not specify ZZ Stealer’s full collection scope or persistence mechanisms, but it is explicitly characterized as an infostealer and linked to malicious package delivery and follow-on loading of customized StormKitty payloads. The content associates it with Iranian cyber activity through its reported correlation with Infy operations.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The expanded toolkit in this phase incorporated commodity tools such as Remcos RAT, Stealerium, StormKitty, and ZZ Stealer...
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.