Malware

Bee Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

A Google token tool accepts an access token and proxy details, helping operators regain account access through stolen session material.

Persistence

1 technique

T1078Valid AccountsEvidence1

A Google token tool accepts an access token and proxy details, helping operators regain account access through stolen session material.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

A Google token tool accepts an access token and proxy details, helping operators regain account access through stolen session material.

Stealth

1 technique

T1078Valid AccountsEvidence1

A Google token tool accepts an access token and proxy details, helping operators regain account access through stolen session material.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence2

Les capacités de collecte couvrent les cookies de navigateurs Chromium et Firefox; le panneau opérateur permet aussi le filtrage des logs par cookies.

T1555Credentials from Password StoresEvidence1

Bee Stealer collecte des identifiants, cookies, données de navigation, autofill et extensions depuis les navigateurs Chromium et Firefox, ainsi que des données d’authentification pour Codex et Claude.

T1555.003Credentials from Web BrowsersEvidence1

Bee Stealer searches for Chromium and Firefox-based browsers, taking cookies, saved logins, browsing data, autofill records, and browser extensions.

Discovery

4 techniques

T1082System Information DiscoveryEvidence2

Les capacités de collecte incluent le « profilage système ».

T1083File and Directory DiscoveryEvidence1

Le file-grabber cible spécifiquement les répertoires Desktop, Downloads et Documents.

T1217Browser Information DiscoveryEvidence1

Bee Stealer searches for Chromium and Firefox-based browsers, taking cookies, saved logins, browsing data, autofill records, and browser extensions.

T1518Software DiscoveryEvidence1

Static analysis confirmed browser collection, application discovery, system profiling, screenshot capture, and dedicated paths for many advertised applications.

Collection

4 techniques

T1005Data from Local SystemEvidence2

Bee Stealer dispose d’un « File-grabber ciblant Desktop, Downloads et Documents » et collecte aussi des données de navigateurs, messagerie, clients email et portefeuilles.

T1113Screen CaptureEvidence2

Les capacités annoncées incluent la « Capture d’écran et profilage système ».

T1119Automated CollectionEvidence1

Other collectors cover email and messaging clients, file-transfer software, password managers, cryptocurrency services, and wallets. A separate file-grabber targets Desktop, Downloads, and Documents.

T1560Archive Collected DataEvidence1

La liste des TTPs détectés dans l’analyse cite « T1560 — Archive Collected Data »; les données sont regroupées sous forme de logs téléchargeables depuis le panneau opérateur.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

« Ce traitement s’effectue après exfiltration des logs vers l’infrastructure attaquante »; l’infrastructure comprend un panneau opérateur permettant le téléchargement en masse des logs.

Impact

1 technique

T1657Financial TheftEvidence1

Bee Stealer collecte des données de « Services et portefeuilles de cryptomonnaies », et le panneau permet le filtrage des logs par wallets.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberveilleNews

Sep 9, 2026

Bee Stealer : un infostealer Windows avec profilage IA des victimes ciblant Codex et Claude | CyberVeille

Windows infostealer sold as MaaS. Version 2.1 steals browser cookies, credentials, browsing and autofill data, email/messaging-client data, password-manager data, cryptocurrency-service and wallet data, files from Desktop/Downloads/Documents, screenshots, and system-profile information. It explicitly collects Codex and Claude authentication data and conversation histories. After exfiltration, operator infrastructure uses an 'AI PC profile' neural-network feature to create English and Russian victim profiles for prioritizing high-value victims.

blackfogNews

Sep 7, 2026

Bee Stealer Targets Codex And Claude, Uses AI To Profile Victims | BlackFog

Windows information stealer sold as malware-as-a-service. It collects browser cookies, saved logins, browsing and autofill data, browser extensions, application data, system-profile information, screenshots, and selected files from Desktop, Downloads, and Documents. It targets authentication data and chat histories from Codex and Claude, and its operator service uses AI-assisted profiling of exfiltrated logs to prioritize valuable victims and accounts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Bee Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

A Google token tool accepts an access token and proxy details, helping operators regain account access through stolen session material.

Persistence

1 technique

T1078Valid AccountsEvidence1

A Google token tool accepts an access token and proxy details, helping operators regain account access through stolen session material.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

A Google token tool accepts an access token and proxy details, helping operators regain account access through stolen session material.

Stealth

1 technique

T1078Valid AccountsEvidence1

A Google token tool accepts an access token and proxy details, helping operators regain account access through stolen session material.

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence2

Les capacités de collecte couvrent les cookies de navigateurs Chromium et Firefox; le panneau opérateur permet aussi le filtrage des logs par cookies.

T1555Credentials from Password StoresEvidence1

T1555.003Credentials from Web BrowsersEvidence1

Bee Stealer searches for Chromium and Firefox-based browsers, taking cookies, saved logins, browsing data, autofill records, and browser extensions.

Discovery

4 techniques

T1082System Information DiscoveryEvidence2

Les capacités de collecte incluent le « profilage système ».

T1083File and Directory DiscoveryEvidence1

Le file-grabber cible spécifiquement les répertoires Desktop, Downloads et Documents.

T1217Browser Information DiscoveryEvidence1

Bee Stealer searches for Chromium and Firefox-based browsers, taking cookies, saved logins, browsing data, autofill records, and browser extensions.

T1518Software DiscoveryEvidence1

Static analysis confirmed browser collection, application discovery, system profiling, screenshot capture, and dedicated paths for many advertised applications.

Collection

4 techniques

T1005Data from Local SystemEvidence2

Bee Stealer dispose d’un « File-grabber ciblant Desktop, Downloads et Documents » et collecte aussi des données de navigateurs, messagerie, clients email et portefeuilles.

T1113Screen CaptureEvidence2

Les capacités annoncées incluent la « Capture d’écran et profilage système ».

T1119Automated CollectionEvidence1

Other collectors cover email and messaging clients, file-transfer software, password managers, cryptocurrency services, and wallets. A separate file-grabber targets Desktop, Downloads, and Documents.

T1560Archive Collected DataEvidence1

La liste des TTPs détectés dans l’analyse cite « T1560 — Archive Collected Data »; les données sont regroupées sous forme de logs téléchargeables depuis le panneau opérateur.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

« Ce traitement s’effectue après exfiltration des logs vers l’infrastructure attaquante »; l’infrastructure comprend un panneau opérateur permettant le téléchargement en masse des logs.

Impact

1 technique

T1657Financial TheftEvidence1

Bee Stealer collecte des données de « Services et portefeuilles de cryptomonnaies », et le panneau permet le filtrage des logs par wallets.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberveilleNews

Sep 9, 2026

Bee Stealer : un infostealer Windows avec profilage IA des victimes ciblant Codex et Claude | CyberVeille

blackfogNews

Sep 7, 2026

Bee Stealer Targets Codex And Claude, Uses AI To Profile Victims | BlackFog

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.