Panda Stealer

Panda Stealer is a Windows information-stealing malware family first observed in 2021 and primarily associated with theft of cryptocurrency wallet data and other user credentials. It has been described as a modified fork or variant of Collector Stealer and is notable for using fileless and in-memory execution techniques to reduce on-disk artifacts and evade detection.

Observed delivery has relied on spam email campaigns, including malicious Excel attachments that either use macros to download a loader or formulas that launch PowerShell. Follow-on stages have used paste-hosted content, PowerShell-based retrieval and decoding, direct in-memory loading of obfuscated .NET assemblies, and process hollowing of a legitimate Microsoft build utility process to execute the final stealer payload.

Panda Stealer targets cryptocurrency-related data including wallet private keys and transaction histories, and it has been reported stealing data from wallets associated with multiple major cryptocurrencies. Beyond wallet theft, it can collect browser-stored information such as cookies, saved passwords, and payment card data; capture screenshots; and steal credentials from applications including VPN, messaging, gaming, and social platforms. Stolen data is staged in temporary files and then exfiltrated to attacker-controlled infrastructure.

The malware has been observed in broad spam waves affecting multiple countries, including the United States, Australia, Japan, and Germany. Infrastructure analysis has linked Panda Stealer activity to numerous command-and-control servers and download sites, and some reporting has noted use of crypter services during testing or deployment. Panda Stealer has also appeared as a payload delivered by other malware distribution mechanisms, including RATDispenser. Its combination of credential theft, cryptocurrency-focused collection, fileless execution, and process hollowing makes it a capable infostealer oriented toward financially motivated intrusion activity.