Malware

Venom Stealer

Venom Stealer is a malware-as-a-service infostealer and phishing kit reported by BlackFog that automates ClickFix-style social engineering attacks and extends beyond typical credential theft. It is sold by a developer using the handle "VenomStealer" via a subscription model with Telegram-based licensing, a vetted application process, and a 15% affiliate program. The platform embeds ClickFix lures directly into its operator panel and provides Windows and macOS templates including fake Cloudflare CAPTCHA, operating system update, SSL certificate error, and font installation pages. These lures instruct victims to open the Windows Run dialog or macOS Terminal, paste a command, and execute it, enabling user-initiated execution that can evade detections based on parent-child process relationships.

BlackFog reported that Venom Stealer delivers a native C++ payload compiled per operator from its web panel. Supported Windows delivery formats include EXE, PS1, HTA, and BAT, while macOS templates use bash and curl. After execution, the malware steals saved passwords, session cookies, browsing history, autofill data, and cryptocurrency wallet vaults from every profile in Chromium- and Firefox-based browsers. It also collects system fingerprinting data and browser extension inventories and exfiltrates the data immediately with little or no local staging.

The malware reportedly bypasses Chrome v10 and v20 password encryption using a silent privilege escalation, including use of the CMSTPLUA COM interface, to extract Chrome decryption keys without triggering a UAC dialog. BlackFog also reported that Venom Stealer persists after initial compromise and continuously monitors Chrome Login Data, polling every 30 seconds to capture newly saved credentials, which undermines password-reset-based response actions.

Venom Stealer also targets cryptocurrency users. Reported wallet targets include MetaMask, Phantom, Solflare, Trust Wallet, Atomic, Exodus, Electrum, Bitcoin Core, Monero, and Tonkeeper. Stolen wallet data is sent to a server-side GPU cracking engine used to crack and drain wallets across nine blockchain networks. A March 9, 2026 update added a File Password and Seed Finder that scans local filesystems for seed phrases and feeds them into the cracking pipeline. BlackFog reported multiple updates during March 2026, indicating active development.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

The web panel enables users to conduct attacks starting from social-engineering templates ... These include a fake Cloudflare CAPTCHA, a fake operating system update, a fake SSL certificate error and fake font installation page.

T1566.002Spearphishing LinkEvidence1

The infection begins when a target lands on a ClickFix page hosted by the operator... Venom ships four templates per platform (Windows and macOS): a fake Cloudflare CAPTCHA, a fake OS update, a fake SSL certificate error, and a fake font install page.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

The ClickFix pages instruct the victim to run commands in the Windows Run dialog or macOS Terminal, using EXE, PS1, HTA or BAT formats for Windows and bash and curl commands for macOS.

T1059.001PowerShellEvidence1

Windows payloads available in the kit include .exe, .psi (or fileless via PowerShell), .hta, and .bat options...

T1059.004Unix ShellEvidence1

...while macOS templates use bash and curl, he said.

T1204User ExecutionEvidence4

Each one asks the target to open a Run dialog or Terminal, paste a command, and press Enter. Because the target initiates execution themselves, the process appears user-initiated and bypasses detection logic built around parent-child process relationships.

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Rather than running once and exiting, Venom stays active on the compromised machine and continuously monitors Chrome’s Login Data file, capturing any new credentials saved after the infection begins.

Privilege Escalation

2 techniques

T1547Boot or Logon Autostart ExecutionEvidence1

T1548Abuse Elevation Control MechanismEvidence2

Chrome’s v10 and v20 password encryption is bypassed through a silent privilege escalation using the CMSTPLUA COM interface, which pulls the decryption key without triggering any UAC dialog and leaves no forensic trace.

Credential Access

3 techniques

T1003OS Credential DumpingEvidence1

Once the payload runs, it immediately sweeps every Chromium and Firefox-based browser on the machine, extracting saved passwords, session cookies, browsing history, autofill data, and cryptocurrency wallet vaults from every profile.

T1539Steal Web Session CookieEvidence4

The moment the payload executes, it sweeps every Chromium and Firefox-based browser on the machine, extracting saved passwords, session cookies, browsing history, autofill data, and cryptocurrency wallet vaults from every profile.

T1555Credentials from Password StoresEvidence3

Discovery

1 technique

T1082System Information DiscoveryEvidence3

System fingerprinting and browser extension inventories are captured alongside the credentials, giving cybercriminals a complete profile of each target.

Collection

2 techniques

T1005Data from Local SystemEvidence3

A March 9 update added a File Password and Seed Finder that scans the local filesystem for seed phrases, putting users at risk even if they never saved credentials directly inside a browser.

T1119Automated CollectionEvidence1

Venom stays active on the compromised machine and continuously monitors Chrome’s Login Data file, capturing any new credentials saved after the infection begins. This session listener polls the file every 30 seconds...

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

...while macOS templates use bash and curl, he said. The platform also gives operators the capability to configure custom domains through Cloudflare DNS, so the panel URL never appears in the command.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence4

As soon as the malware is installed, it instantly scans the machine for sensitive information and immediately sends it to the attackers.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

knowbe4 blogNews

Apr 13, 2026

New Phishing Kit Streamlines ClickFix Attacks

Commodity stealer/phishing kit that automates ClickFix social engineering attacks, installs via user-executed commands, and continuously exfiltrates data including saved passwords, session cookies, browsing history, autofill data, cryptocurrency wallet vaults, system fingerprints, and browser extension inventories. It also reportedly bypasses Chrome v10 and v20 password encryption using silent privilege escalation.

cyber security newsNews

Apr 3, 2026

Hackers Use Venom Stealer to Turn ClickFix Lures Into Full Data Exfiltration Pipelines

An infostealer MaaS platform that uses ClickFix social engineering for delivery, steals browser credentials, cookies, history, autofill data, and cryptocurrency wallet vaults, bypasses Chrome password encryption via CMSTPLUA COM-based privilege escalation, maintains persistence by continuously monitoring Chrome Login Data for newly saved credentials, and supports automated wallet cracking and draining.

scworldNews

Apr 1, 2026

Venom Stealer MaaS handles attacks from ClickFix to crypto theft | news | SC Media

Venom Stealer is a malware-as-a-service infostealer used in ClickFix social-engineering attacks. It is delivered via fake CAPTCHA, OS update, SSL certificate error, and font installation lures, and uses Windows and macOS command execution to infect victims. The malware targets Chromium and Firefox browsers to steal saved passwords, session cookies, browsing history, autofill data, and cryptocurrency wallet vaults. It reportedly bypasses Chrome v10 and v20 password encryption, rapidly exfiltrates data, persists on infected systems, monitors Chrome for newly saved credentials, and passes stolen wallet data to a wallet-cracking engine for theft of cryptocurrency funds.

dark readingNews

Apr 1, 2026

Venom Stealer MaaS Platform Commoditizes ClickFix Attacks

An information-stealing malware-as-a-service platform that automates ClickFix-style social engineering attacks, delivers native payloads for Windows and macOS, steals credentials, cookies, browser data, and cryptocurrency wallet information, and maintains persistent monitoring for ongoing exfiltration.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Venom Stealer