Loading malware…
BeautyStealer is a C++ information stealer for Windows developed and used by the Russia-aligned cyberespionage group Gorbag. It is the group's principal data-collection tool in campaigns against Ukrainian organizations, including law enforcement and judicial bodies, frontline local administrations, defense entities, and infrastructure supporting the transportation of foreign military aid.
BeautyStealer harvests saved passwords, cookies, browsing history, and other browser data from Chrome, Edge, Opera, and Firefox. It also collects OpenVPN configurations and selected files from user folders, removable media, and mapped network drives. Targeted material includes Office documents, archives, email records, password databases, remote-access configurations, certificates, and private-key material, including Ukrainian electronic-signature keys. Collected information is archived and exfiltrated through Telegram or a custom server implemented with FastAPI. The malware attempts to delete itself after exfiltration, emphasizing rapid information harvesting rather than sustained remote control.
During 2025, BeautyStealer was delivered through spearphishing emails using administrative-fine and tax-related lures. Macro-enabled Excel attachments contained encoded payloads that VBA code decoded and executed. In early 2026, the delivery chain shifted to weaponized RAR archives exploiting the WinRAR path traversal vulnerability CVE-2025-8088. These archives displayed a PDF decoy and deployed an encrypted payload, a PowerShell loader, and a startup shortcut that launched the loader on subsequent system starts.
Versions tracked from 0.9 through 2.0 expanded from browser-credential theft to broader file collection and introduced additional encryption, custom-server exfiltration, and revised self-deletion mechanisms. Later versions incorporated XOR-based string protection and RC4 encryption.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Gorbag acquires servers for Prime ReverseShell and BeautyStealer.
Gorbag develops BeautyStealer.
Throughout 2025, Gorbag relied on spearphishing emails containing a malicious attachment.
Gorbag uses PowerShell for archive creation and a reverse shell.
Gorbag began delivering weaponized RAR archives that exploit CVE-2025-8088, a WinRAR path traversal vulnerability.
Gorbag lures victims into opening weaponized files and activating macros, which triggers code execution.
The LNK file provides persistence by triggering the loader on subsequent system startups or restarts.
The LNK file provides persistence by triggering the loader on subsequent system startups or restarts.
A short and not very elaborate VBA routine decodes a base64-encoded payload embedded in the spreadsheet cells.
BeautyStealer removes itself after exfiltration.
BeautyStealer steals cookies from multiple browsers.
BeautyStealer harvests credentials from multiple browsers.
BeautyStealer collects history from browsers.
Files with specific extensions ... located in the victim’s Desktop, Documents, and Downloads folders.
Stolen data is compressed into an archive and exfiltrated.
BeautyStealer encrypts stolen files and credentials using RC4 before exfiltration.
Exfiltrated either to an attacker-controlled Telegram chat via the Telegram sendDocument API.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.