Malware

Braodo Stealer

Braodo Stealer is a Python-based information-stealing malware family targeting Windows systems. It is designed to harvest sensitive data from compromised hosts, including browser credentials, stored passwords, cookies, browser history, clipboard contents, screenshots, running-process information, and host metadata such as operating system details, username, hostname, and geolocation-related system context. The malware has been observed targeting credential stores in major browsers including Chrome, Firefox, Microsoft Edge, Opera, Brave, and Chromium-derived applications.

Braodo Stealer commonly uses a multi-stage infection chain built around heavy obfuscation. Observed campaigns have used obfuscated Windows batch-script loaders, including variants employing BOM-based rendering tricks and ABOBUS-style batch obfuscation, to conceal execution logic. These loaders invoke PowerShell to retrieve additional payload stages from legitimate code-hosting or file-sharing services, after which a second-stage Python component decodes and decrypts the final stealer payload before execution. Some variants also use legitimate online services for payload hosting and Telegram bot infrastructure for command-and-control and exfiltration.

Once active, Braodo Stealer performs host reconnaissance and data collection, enumerates running processes, captures screenshots, accesses clipboard contents, and extracts credentials and cookies from web browsers. Variants have been observed terminating browser processes before attempting credential extraction in order to unlock browser data stores and avoid file-access conflicts. Stolen data is staged locally, often archived, and then exfiltrated through attacker-controlled Telegram channels. Some variants establish persistence through Windows Registry Run-key mechanisms.

Braodo Stealer has been associated with phishing-driven and malicious-download delivery, and its use of trusted web platforms and layered obfuscation contributes to stealth and detection evasion. Its operational objective is credential theft and broader collection of victim data that can enable unauthorized access to personal, financial, social-media, and business accounts.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Braodo Stealer often infiltrates through phishing campaigns or malicious downloads... Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device.

Execution

3 techniques

T1059.001PowerShellEvidence1

PowerShell 4104 Hunting ... T1059.001 ... Malicious PowerShell

T1059.005Visual BasicEvidence1

Annotations ID Technique Tactic T1059.005 Visual Basic Execution

T1204User ExecutionEvidence1

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - T1547.001 The use of the Windows Registry Run keys to maintain persistence has been a common theme across these families.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - T1547.001 The use of the Windows Registry Run keys to maintain persistence has been a common theme across these families.

Stealth

2 techniques

T1027.010Command ObfuscationEvidence1

"The Braodo Stealer campaign commonly employs an obfuscated batch script as a loader... Random Named Environment Variable... Byte Order Mark (BOM) and Obfuscator"

T1027.013Encrypted/Encoded FileEvidence1

"second-stage Python script... responsible for base64 decoding and decrypting the AES-encrypted Braodo Stealer payload stored in the 'Error_cache.db' file"

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence1

This malware typically targets login credentials, browser history, cookies, and stored passwords... steals login credentials, captures cookies...

T1555Credentials from Password StoresEvidence1

This malware typically targets login credentials, browser history, cookies, and stored passwords... it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications.

T1555.003Credentials from Web BrowsersEvidence3

Credentials from Web Browsers - T1555.003 11 of these malware families also commonly target and decrypt sensitive credentials stored in browser databases.

Discovery

1 technique

T1082System Information DiscoveryEvidence2

System Information Discovery – T1082 System Information Discovery comes second, and here these malware families often aim to collect information such as the computer's name, OS, Memory, etc.

Collection

3 techniques

T1113Screen CaptureEvidence3

T1113 Agent Tesla, AsyncRAT, Braodo Stealer, gh0st RAT, Lumma Stealer, njRAT, PlugX, RedLine Stealer, Remcos, XWorm

T1115Clipboard DataEvidence1

"Braodo Stealer also collects clipboard data"

T1213Data from Information RepositoriesEvidence1

"The Splunk Threat Research Team has observed several active Braodo Stealer campaigns in the wild, abusing popular developer platforms like GitHub and GitLab... These platforms are abused to host and distribute malicious payloads"

Command and Control

1 technique

T1102Web ServiceEvidence1

Web Service - T1102 6 of these malware families abuse legitimate web services either as their command‑and‑control infrastructure or as remote storage locations for updated payloads that are later retrieved by their stagers or loaders.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

"This malware utilizes a Telegram bot as its C2 server, enabling it to transmit all collected sensitive data"

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

The following analytic detects the use of the taskkill command in a process command line to terminate several known browser processes, a technique commonly employed by the Braodo stealer malware to steal credentials. By forcefully closing browsers like Chrome, Edge, and Firefox, the malware can unlock files that store sensitive information, such as passwords and login data.

INDICATORS OF COMPROMISE

IOCs tracked for this family

15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

14 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app1 month ago

hash.md5●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

splunk researchNews

May 13, 2026

Detection: Any Powershell DownloadFile | Splunk Security Content

Referenced as an associated analytic story; no further details are provided in the content.

splunk security blogNews

Jan 23, 2026

A Shared Arsenal: Identifying Common TTPs Across RATs | Splunk

Information stealer with a Python-based component that extracts browser credentials and uses an obfuscated loader to download payloads from abused legitimate services such as GitLab or Dropbox.

splunk researchNews

Dec 10, 2025

Detection: Suspicious Process DNS Query Known Abuse Web Services | Splunk Security Content

Associated Analytic Story Braodo Stealer

splunk researchNews

Oct 24, 2024

Analytics Story: Braodo Stealer | Splunk Security Content

Information-stealing malware that targets login credentials, browser history, cookies, and stored passwords. It is described as spreading through phishing campaigns or malicious downloads and enabling unauthorized access to personal, financial, and business accounts.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching15

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Braodo Stealer