Malware

KuinaExtractor

Tracked since Jun 26, 2026 · Updated 5 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK11Techniques

IOCs1Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence2

Privilege escalation fodhelper / ms-settings in early builds; SilentCleanup in later builds UAC-bypass attempts are a strong sign the infection is more than a nuisance download.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

The latest build wraps its strings in 28-byte XOR encryption, ships its own certificate roots instead of relying on the system’s trusted store...

T1497Virtualization/Sandbox EvasionEvidence1

...and adds a sandbox check that scans PowerShell window titles for analyst tools.

Defense Impairment

1 technique

T1685Disable or Modify ToolsEvidence2

Defender tampering Loop that disables Microsoft Defender in the January rewrite

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence1

The earliest builds already targeted more than ordinary browser cookies. Threatray reports theft of Roblox cookies, Steam sessions, crypto wallets, Discord tokens, browser data, and credentials.

T1555Credentials from Password StoresEvidence2

Later versions added Windows Credential Manager collection... A user may need to secure Discord, Steam, Roblox, crypto wallets, Telegram data, FileZilla credentials, Windows saved credentials, and accounts that were opened in the affected browser.

T1649Steal or Forge Authentication CertificatesEvidence2

Threatray reports theft of Roblox cookies, Steam sessions, crypto wallets, Discord tokens, browser data, and credentials.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

The January rewrite also added extensive reconnaissance before any data theft began. Eight hardware queries using WMIC, WiFi network enumeration... and victim IP geolocation all ran ahead of the main theft routine.

T1082System Information DiscoveryEvidence2

Windows collection Windows Credential Manager dump, WMIC hardware queries, Wi-Fi SSID enumeration

T1497Virtualization/Sandbox EvasionEvidence1

...and adds a sandbox check that scans PowerShell window titles for analyst tools.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

GitHub was used both as a delivery host and as disposable remote infrastructure through GitHub Actions. That infrastructure role with GitHub remains active today.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence2

In the January branch, exfiltration moved from a Discord webhook to a Telegram bot. By June... uses a one-way Telegram channel for file upload.

Indicators of compromise

Observables

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

trojan killer newsNews · Jul 6, 2026TimbreStealer Hides Behind Edge and Google Update DLLsReferenced as another malware involved in browser data theft.Read more ↗trojan killer newsNews · Jun 28, 2026KuinaExtractor Rebrands as k0to While Stealing Browser DataA Rust-based infostealer focused on credential and session theft. It steals browser data, Discord tokens, Steam and Roblox sessions, crypto wallet data, Windows-stored credentials, and later added Windows Credential Manager collection, Wi-Fi SSID enumeration, anti-analysis features, Defender tampering, UAC-bypass attempts, and Telegram-based exfiltration.Read more ↗cyber security newsNews · Jun 26, 2026KuinaExtractor Uses Telegram Exfiltration, UAC Bypass, and Sandbox Detection for StealthA Rust-based infostealer that steals browser data, cryptocurrency wallet data, and credentials from popular services. Over time it added Chrome App-Bound-Encryption bypass, Telegram-based exfiltration, multiple UAC bypass techniques, reconnaissance, Microsoft Defender disabling attempts, string encryption, custom certificate roots, and sandbox detection.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching1Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

KuinaExtractor

Tracked since Jun 26, 2026 · Updated 5 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK11Techniques

IOCs1Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure