Loading story…
Rhadamanthys, a prominent information-stealing malware, has undergone significant evolution, expanding its capabilities and threat profile. Initially promoted on cybercrime forums by a threat actor known as kingcrete2022, Rhadamanthys has become a leading malware-as-a-service (MaaS) offering, rivaling other popular stealers such as Lumma, Vidar, StealC, and Acreed. The malware's latest version, 0.9.2, introduces advanced features including device and web browser fingerprinting, as well as the use of PNG steganography for payload delivery, enhancing its ability to evade detection and exfiltrate sensitive data. Previous updates, such as version 0.7.0, incorporated artificial intelligence-based optical character recognition (OCR) to capture cryptocurrency wallet seed phrases, demonstrating the developers' commitment to integrating cutting-edge techniques. The operators have rebranded as "RHAD security" and "Mythical Origin Labs," marketing Rhadamanthys as an "intelligent solution" and offering it in tiered packages ranging from $299 to $499 per month, with an enterprise option available for direct negotiation. This business-like approach, including a structured product portfolio and customer support, signals a long-term strategy to maintain and grow their presence in the cybercrime ecosystem. The stealer is distributed through various channels, including fake software and phishing campaigns, targeting both individuals and organizations. Its modular architecture allows for rapid adaptation to new security measures, making it a persistent threat. Security researchers have observed that Rhadamanthys is frequently updated, with new features aimed at bypassing modern defenses and increasing the value proposition for cybercriminal customers. The malware's ability to collect a wide range of credentials, financial information, and system data poses significant risks to both personal and corporate security. Defensive measures must account for its evolving tactics, including the use of steganography and AI-driven data extraction. The growing sophistication and commercialization of Rhadamanthys reflect broader trends in the cybercrime-as-a-service market, where threat actors continuously innovate to outpace defenders. Organizations are urged to implement robust endpoint protection, monitor for indicators of compromise, and educate users about the risks of downloading software from untrusted sources. The ongoing development and aggressive marketing of Rhadamanthys underscore the need for continuous vigilance and adaptive security strategies in the face of rapidly evolving malware threats.
Pull IOCs and campaign context straight into your stack.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rhadamanthys Stealer, a well-known multi-modular information-stealing malware, has released version 0.9.2, which incorporates significant technical advancements aimed at evading detection and complicating analysis. The latest update introduces the use of PNG files as payload carriers, a technique that allows the malware to disguise its malicious components within seemingly innocuous image files, thereby bypassing traditional security controls that may not inspect image content for embedded threats. Security researchers have observed that this version also implements new anti-analysis tricks, making it more challenging for analysts and automated tools to dissect and understand the malware’s behavior. These anti-analysis features include enhanced obfuscation, custom executable formats, and string deobfuscation, all of which are designed to thwart reverse engineering efforts. The malware’s modular architecture remains intact, allowing threat actors to customize and deploy various functionalities depending on their objectives. Rhadamanthys has been actively used in multiple cybercrime campaigns since its initial release in 2022, and its continued evolution demonstrates the sophistication and adaptability of its developers. The malware’s popularity on underground forums has led to its adoption by a wide range of threat actors, including those with advanced capabilities. Security researchers from Check Point have provided tools and scripts to help defenders adapt to these changes, including converters for the new executable format and unpackers for the updated module packages. The use of PNG payloads is particularly concerning, as it leverages a common file type to evade detection and can be distributed through various channels, including phishing emails and compromised websites. The anti-analysis enhancements mean that defenders must update their detection and response strategies to account for these new evasion techniques. The malware’s ability to steal credentials, exfiltrate sensitive data, and provide remote access to compromised systems continues to pose a significant threat to organizations. The rapid pace of development and the introduction of novel techniques in version 0.9.2 underscore the need for continuous monitoring and adaptation by security teams. Researchers emphasize the importance of threat intelligence sharing and the use of updated detection tools to mitigate the risks posed by Rhadamanthys. The ongoing updates to Rhadamanthys highlight the broader trend of malware authors adopting increasingly sophisticated methods to bypass security controls and hinder analysis. Organizations are advised to review their security controls, ensure endpoint protection solutions are updated, and educate users about the risks associated with opening suspicious files, even those that appear to be harmless images. The technical community continues to monitor Rhadamanthys for further developments, as its evolution is likely to influence the tactics of other malware families in the cybercrime ecosystem.
Jun 29, 2026
Rhadamanthys emerged as a fast-growing malware-as-a-service infostealer sold on criminal forums, using aggressive promotion and frequent updates to attract operators. Researchers found it delivered through lures including fake AnyDesk installers and malicious Google Ads, then executed through a multi-stage chain involving packed droppers, shellcode, custom loaders, VM-evasion, API unhooking, and obfuscated command-and-control retrieval. The malware was observed attempting infections beyond broad consumer targeting, including a Canadian government agency and an Indian energy company, while generally avoiding CIS targets. Technical analysis showed Rhadamanthys stealing credentials, cookies, browser data, and information from password managers, VPNs, messaging apps, email clients, FTP tools, gaming platforms, and cryptocurrency wallets. Later versions, including `v0.5.0`, added a plugin architecture, keylogging, spyware-like data collection, Lua and .NET extensions, process injection, raw and indirect syscalls, Heaven’s Gate, and ETW/AMSI bypasses, allowing operators to fetch and run additional modules from C2 infrastructure. Researchers also reconstructed its final payload behavior from memory artifacts, showing how the malware parses Chrome SQL and JSON stores and executes downloaded components via `rundll32` to broaden theft and post-compromise capability.
Aug 15, 2026
Check Point Research reported a large-scale phishing operation distributing **Rhadamanthys** stealer version `0.7` through copyright-infringement lures. Since at least July 2024, the campaign has impersonated dozens of companies—especially in entertainment, media, and software—and sent tailored emails from unique Gmail accounts to targets across the United States, Europe, the Middle East, East Asia, and South America. The messages pressure recipients to review alleged intellectual-property violations and download password-protected archives, giving the operation broad reach while preserving a spear-phishing appearance. The infection chain uses **DLL sideloading** with legitimate executables to install the malware, establish persistence, and connect to command-and-control infrastructure before fetching additional modules. Researchers said the latest build includes a new OCR-related component marketed as AI-powered, but analysis indicates it relies on older OCR-style machine-learning techniques and is likely intended to identify **BIP39** cryptocurrency wallet seed phrases in images and documents. Check Point assessed that the operation is more consistent with a financially motivated cybercrime group than a nation-state actor because of its automated infrastructure and indiscriminate targeting.
Aug 14, 2026