Loading malware…
Jester Stealer is a Windows information-stealing malware family that emerged in early 2022 and is designed to harvest a broad range of sensitive data from infected systems. Its theft scope includes login credentials, browser cookies, payment card data, and information stored by password managers, chat and messaging applications, email clients, cryptocurrency wallets, and gaming applications. The malware is part of the broader wave of commodity stealers that expanded after disruption to other prominent stealer operations.
Jester Stealer has been discussed alongside other MaaS-style and commodity credential theft ecosystems, and reporting has noted code-level or developmental similarities with other stealers, including possible derivation from the DynamicStealer GitHub project. Analysis has also suggested similarities or possible lineage overlap with the Eternity Project stealer module, indicating reuse, modification, or rebranding within the cybercrime market.
The malware’s primary function is credential and data theft for downstream criminal use, including account compromise, fraud, and resale of stolen information. High-confidence reporting supports its targeting of consumer and enterprise application data rather than destructive or ransomware-style effects. Jester Stealer is associated with the infostealer threat landscape affecting general internet users and organizations whose employees store credentials, financial data, communications data, or cryptocurrency wallet material on Windows endpoints.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another information-stealer that appeared during Raccoon Stealer's hiatus.
A stealer mentioned as possibly rebranded from the same GitHub project allegedly leveraged by the Eternity developer.
An information-stealing malware referenced as similar to the Eternity stealer module and likely sharing code ancestry via DynamicStealer.
An info-stealer engineered to steal credentials, cookies, credit card data, and information from password managers, messengers, email clients, crypto wallets, and gaming apps.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.