Kynx

While unconfirmed, this setup indicates the actor intends to distribute Kynx via cracked software or a ClickFix lure.

it searches the GamingRobloxdecrypted_cookie.txt and then spawns a hidden PowerShell one-liner to decrypt DPAPI-protected browser master keys.

Upon execution, Kynx opens with a fake “System update” banner, rendering an animated terminal progress bar cycling through messages like “Downloading required files” and “Please wait while we sync with the server,” mimicking a software update page.

It then actively navigates the filesystem to locate and delete specific security tools and client modifications, systematically removing ProtectionPayload.dll and secure.dat to disable DiscordTokenProtector , alongside deleting BetterDiscord archives ( betterdiscord.asar ).

Before Kynx initiates its credential harvesting modules, it runs a function to check if it is being executed inside a malware analyst’s lab, an automated antivirus sandbox, or a virtual machine.

It does this by running a series of hardware and software checks, assigning “penalty points” for suspicious findings.

Being Debugged (PEB) +10 Process Environment Block inspection for BeingDebugged flag

Kynx starts by implementing a four-method cascade (MCE -> DBS -> ChromeElevator -> raw copy) for browser credential extraction, falling back to successive methods on failure.

After collecting the data, Kynx also categorizes active session tokens from web services. Each session file is saved with usage instructions so the operator can immediately replay the session on each service.

Kynx also performs Discord token theft by first removing the protections, then scanning for tokens, and then using Discord’s API to enumerate the accounts behind those tokens.

Kynx calls CreateToolhelp32Snapshot() to generate a list of every process currently running on the victim’s machine. It loops through the running tasks and performs a string comparison against an array of hardcoded endpoint security and malware analysis tools.

Before Kynx initiates its credential harvesting modules, it runs a function to check if it is being executed inside a malware analyst’s lab, an automated antivirus sandbox, or a virtual machine.

It does this by running a series of hardware and software checks, assigning “penalty points” for suspicious findings.

Being Debugged (PEB) +10 Process Environment Block inspection for BeingDebugged flag

In addition, the stealer scans the Desktop, Documents, and Downloads folders for seed phrase documents through the regular expression

files Archive of grabbed files (multipart/form-data:“ files.zip ”, staging file: “ kynx_files.zip ”)

It downloads the executable from hxxps[://]kynxdev[.]xyz/payloads/mce[.]exe ... to disk and runs it using CreateProcessA

For exfiltration, Kynx utilizes the ChunkSender module which uses HTTP POST requests through data chunks sequentially towards the web panel ( hxxps[://]kynxdev[.]xyz/api/v1/ingest.php?cat={chunk} ).