Loading story…
Rhadamanthys Stealer, a well-known multi-modular information-stealing malware, has released version 0.9.2, which incorporates significant technical advancements aimed at evading detection and complicating analysis. The latest update introduces the use of PNG files as payload carriers, a technique that allows the malware to disguise its malicious components within seemingly innocuous image files, thereby bypassing traditional security controls that may not inspect image content for embedded threats. Security researchers have observed that this version also implements new anti-analysis tricks, making it more challenging for analysts and automated tools to dissect and understand the malware’s behavior. These anti-analysis features include enhanced obfuscation, custom executable formats, and string deobfuscation, all of which are designed to thwart reverse engineering efforts. The malware’s modular architecture remains intact, allowing threat actors to customize and deploy various functionalities depending on their objectives. Rhadamanthys has been actively used in multiple cybercrime campaigns since its initial release in 2022, and its continued evolution demonstrates the sophistication and adaptability of its developers. The malware’s popularity on underground forums has led to its adoption by a wide range of threat actors, including those with advanced capabilities. Security researchers from Check Point have provided tools and scripts to help defenders adapt to these changes, including converters for the new executable format and unpackers for the updated module packages. The use of PNG payloads is particularly concerning, as it leverages a common file type to evade detection and can be distributed through various channels, including phishing emails and compromised websites. The anti-analysis enhancements mean that defenders must update their detection and response strategies to account for these new evasion techniques. The malware’s ability to steal credentials, exfiltrate sensitive data, and provide remote access to compromised systems continues to pose a significant threat to organizations. The rapid pace of development and the introduction of novel techniques in version 0.9.2 underscore the need for continuous monitoring and adaptation by security teams. Researchers emphasize the importance of threat intelligence sharing and the use of updated detection tools to mitigate the risks posed by Rhadamanthys. The ongoing updates to Rhadamanthys highlight the broader trend of malware authors adopting increasingly sophisticated methods to bypass security controls and hinder analysis. Organizations are advised to review their security controls, ensure endpoint protection solutions are updated, and educate users about the risks associated with opening suspicious files, even those that appear to be harmless images. The technical community continues to monitor Rhadamanthys for further developments, as its evolution is likely to influence the tactics of other malware families in the cybercrime ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A follow-up report described Rhadamanthys Stealer v0.9.2 as adding new PNG-based payload delivery and anti-analysis techniques, indicating a further iteration in the malware's development. The coverage framed these changes as making the malware more evasive and dangerous.
Check Point Research published an analysis of Rhadamanthys 0.9.x, describing updates to the stealer's capabilities and evolution. The report indicates the malware had already introduced meaningful changes in the 0.9.x branch by the time of publication.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rhadamanthys, a prominent information-stealing malware, has undergone significant evolution, expanding its capabilities and threat profile. Initially promoted on cybercrime forums by a threat actor known as kingcrete2022, Rhadamanthys has become a leading malware-as-a-service (MaaS) offering, rivaling other popular stealers such as Lumma, Vidar, StealC, and Acreed. The malware's latest version, 0.9.2, introduces advanced features including device and web browser fingerprinting, as well as the use of PNG steganography for payload delivery, enhancing its ability to evade detection and exfiltrate sensitive data. Previous updates, such as version 0.7.0, incorporated artificial intelligence-based optical character recognition (OCR) to capture cryptocurrency wallet seed phrases, demonstrating the developers' commitment to integrating cutting-edge techniques. The operators have rebranded as "RHAD security" and "Mythical Origin Labs," marketing Rhadamanthys as an "intelligent solution" and offering it in tiered packages ranging from $299 to $499 per month, with an enterprise option available for direct negotiation. This business-like approach, including a structured product portfolio and customer support, signals a long-term strategy to maintain and grow their presence in the cybercrime ecosystem. The stealer is distributed through various channels, including fake software and phishing campaigns, targeting both individuals and organizations. Its modular architecture allows for rapid adaptation to new security measures, making it a persistent threat. Security researchers have observed that Rhadamanthys is frequently updated, with new features aimed at bypassing modern defenses and increasing the value proposition for cybercriminal customers. The malware's ability to collect a wide range of credentials, financial information, and system data poses significant risks to both personal and corporate security. Defensive measures must account for its evolving tactics, including the use of steganography and AI-driven data extraction. The growing sophistication and commercialization of Rhadamanthys reflect broader trends in the cybercrime-as-a-service market, where threat actors continuously innovate to outpace defenders. Organizations are urged to implement robust endpoint protection, monitor for indicators of compromise, and educate users about the risks of downloading software from untrusted sources. The ongoing development and aggressive marketing of Rhadamanthys underscore the need for continuous vigilance and adaptive security strategies in the face of rapidly evolving malware threats.
Jun 29, 2026
Rhadamanthys emerged as a fast-growing malware-as-a-service infostealer sold on criminal forums, using aggressive promotion and frequent updates to attract operators. Researchers found it delivered through lures including fake AnyDesk installers and malicious Google Ads, then executed through a multi-stage chain involving packed droppers, shellcode, custom loaders, VM-evasion, API unhooking, and obfuscated command-and-control retrieval. The malware was observed attempting infections beyond broad consumer targeting, including a Canadian government agency and an Indian energy company, while generally avoiding CIS targets. Technical analysis showed Rhadamanthys stealing credentials, cookies, browser data, and information from password managers, VPNs, messaging apps, email clients, FTP tools, gaming platforms, and cryptocurrency wallets. Later versions, including `v0.5.0`, added a plugin architecture, keylogging, spyware-like data collection, Lua and .NET extensions, process injection, raw and indirect syscalls, Heaven’s Gate, and ETW/AMSI bypasses, allowing operators to fetch and run additional modules from C2 infrastructure. Researchers also reconstructed its final payload behavior from memory artifacts, showing how the malware parses Chrome SQL and JSON stores and executes downloaded components via `rundll32` to broaden theft and post-compromise capability.
Aug 15, 2026
Security researchers reported multiple malware delivery chains that **hide or embed executable payloads inside image files** to evade detection. Veracode analyzed a malicious typosquatted NPM package, `buildrunner-dev`, that uses a `postinstall` hook to run `init.js`, which downloads an obfuscated batch script (`packageloader.bat`) from a Codeberg repository. The batch script ultimately retrieves PNG images hosted on a free image service and extracts hidden data from RGB pixel values (steganography), leading to a loader with **process hollowing**, **encrypted payload handling**, **AMSI bypass**, and per-AV evasion logic, culminating in deployment of the **Pulsar .NET RAT**. Separately, SANS ISC documented a phishing/malspam-style infection chain starting from an Excel attachment exploiting **CVE-2017-11882** (Equation Editor), which downloads an HTA that launches PowerShell to fetch a PNG (`optimized_MSI.png`) containing a Base64-encoded .NET payload delimited by `BaseStart-` and `-BaseEnd` tags. The handler noted **reuse of the same image across campaigns**, used VirusTotal similarity searches to identify many related samples, and produced a YARA rule to track the technique. Kaspersky’s write-up on **Arkanix Stealer** describes a MaaS stealer ecosystem (C++ and Python variants, ChromElevator usage, and broad credential/crypto theft) but does not center on image-based payload hiding, making it a separate topic from the image-steganography delivery chains described by Veracode and SANS ISC.
Jun 29, 2026