Loading malware…
Needle is a Windows-focused information-stealing and cryptocurrency-theft platform operated as malware-as-a-service. Its core functionality includes theft of browser passwords, cookies, authentication tokens, payment-card details, autofill records, browsing history, extension data, FTP credentials, Telegram sessions, and cryptocurrency wallet files. It also supports screenshots, system-information collection, form grabbing, and clipboard hijacking.
Needle combines these collection capabilities with browser and desktop cryptocurrency-wallet spoofers and wallet-draining functionality. Targeted wallet products include MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Ledger, Trezor, Exodus, and Atomic. Its cryptocurrency-theft features cover multiple blockchain ecosystems, including Ethereum, Solana, Tron, Bitcoin, and several Ethereum-compatible networks.
Operators can generate customized payloads through builder and launcher systems with per-build API keys and configurable options. Administration uses a web-based operator panel with English and Russian interfaces and Telegram-integrated notifications for stolen-data logs, wallet-spoofing events, and panel activity. Multiple separately compiled customer-panel deployments have been identified. Needle has been observed in a Phorpiex/Trik delivery ecosystem that also distributed separate credential-enabled spam and Monero-mining payloads; those companion payloads are distinct from Needle's core stealer functionality.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Behind the distribution server, we found Needle — a previously undocumented crimeware-as-a-service platform with browser and desktop wallet spoofers covering 8+ blockchains, a stealer, form grabber, clipper, builder system, launcher framework, and Telegram-integrated C2.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Nine of those responded on April 22, 2026 at 02:53 UTC with a <title>Needle</title> SPA and a healthy /api/v2/health endpoint... each deployment is separately compiled, confirming Needle operates a genuine multi-tenant MaaS model.
MITRE ATT&CK Mapping ... Credential Access Input Capture: Web Portal Capture T1056.003 Form Grabber
Bearer-JWT auth on /api/v2/* authenticated endpoints, with the token stored in localStorage["auth_token"] client-side
API key embedded in plain text inside the Rust malware unlocked 1,932 victims and the operator's withdrawal config
Needle Core ... Specifically: Module What It Steals Passwords Saved browser passwords from all profiles
The bundles are the client-side SPA for the Needle operator panel... they render the browser-stealer panel UI.
MITRE ATT&CK Mapping ... Credential Access Input Capture: Web Portal Capture T1056.003 Form Grabber
Needle Core ... Specifically: Module What It Steals ... Screenshots Desktop screenshots
Needle Core ... Specifically: Module What It Steals ... Clipper Clipboard cryptocurrency address replacement
Nine live Needle MaaS customer panels confirmed on TCP 3000, each serving a separately-compiled Vite bundle with a distinct SHA-256 hash.
MITRE ATT&CK Mapping ... Command and Control Application Layer Protocol: Web T1071.001 HTTP C2 to port 80/3000
MITRE ATT&CK Mapping ... Command and Control Web Service: Dead Drop Resolver T1102.001 Telegram bot notifications
The April 20 report focused on one Needle panel — 178.16.54[.]109 — and documented it end-to-end from the Phorpiex/Trik delivery worm through the wallet-drainer capability set, the private Monero mining pool on :6060...
MITRE ATT&CK Mapping ... Exfiltration Exfiltration Over C2 Channel T1041 Stealer data exfiltration
The bundles do not contain the Phorpiex worm, the wallet-drainer stage, or the Monero miner — those are server-issued payloads documented in the original April 20 report.
MITRE ATT&CK Mapping ... Impact Financial Theft T1657 Wallet draining (browser + desktop)
46 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.