Loading story…
Russian-linked threat actors have been distributing the StealC V2 infostealer by uploading weaponized Blender .blend files to popular 3D model marketplaces such as CGTrader. These malicious files exploit Blender’s feature that allows embedded Python scripts to run automatically if the 'Auto Run Python Scripts' option is enabled. Unsuspecting users who download and open these files trigger the execution of hidden scripts, which initiate a multi-stage attack chain involving the download of additional payloads, including PowerShell scripts and ZIP archives containing Python-based stealers. The campaign has been active for at least six months and has been linked to previous operations targeting gaming communities with similar tactics and infrastructure.
Morphisec, a cybersecurity firm, successfully detected and blocked several instances of this campaign, providing technical analysis of the attack chain and infrastructure. The StealC V2 malware is capable of stealing credentials and data from over two dozen browsers, more than 15 desktop wallets, and a wide range of plugins and communication applications. This campaign marks the first public attribution of malicious Blender files to StealC and Russian threat actors, highlighting the evolving threat landscape for creative professionals and the risks associated with downloading third-party assets from online marketplaces.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Morphisec published research describing how malicious Blender files abused Auto Run Python Scripts to install StealC V2, along with indicators of compromise such as domains, IPs, and file hashes. The disclosure also warned that this appeared to be the first reported linkage between StealC or Russian-speaking threat actor tradecraft and Blender file abuse.
Morphisec identified the campaign and blocked multiple infection attempts in which embedded Python scripts in .blend files launched a multi-stage chain involving PowerShell, ZIP archives, persistence mechanisms, and Pyramid C2 communications. The firm said its platform stopped the malware before data exfiltration and linked the activity to Russian-speaking threat actor patterns.
Russian-speaking threat actors began distributing weaponized Blender .blend files on 3D model marketplaces such as CGTrader to deliver the StealC V2 infostealer. The campaign was reported as having been active for at least six months before its public disclosure in late November 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcetherecord.media
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcemorphisec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have leveraged popular creative content platforms and multimedia files to distribute infostealer malware to unsuspecting users. In one case, attackers uploaded free 3D model files containing malicious Python scripts to the CGTrader marketplace for use with the open-source Blender software. If users had Blender's "Auto Run Python Scripts" feature enabled, simply opening the .blend file would execute the embedded script, which then connected to a remote server to download a malware loader, ultimately infecting the system with the StealC V2 infostealer. This attack highlights the risks associated with open-source tools that allow automation and the lack of security controls on user-generated content marketplaces. In a separate but thematically similar incident, Bitdefender researchers discovered a torrent file for the movie "One Battle After Another" that was used to deliver the Agent Tesla malware. The attack chain began when users launched a shortcut file included in the torrent, which triggered a series of PowerShell scripts hidden within a subtitle file. These scripts extracted and executed additional payloads from other files in the torrent, ultimately running the Agent Tesla infostealer entirely in memory to evade detection. Both incidents demonstrate the increasing sophistication of malware delivery methods that exploit trusted creative and entertainment platforms, targeting users through seemingly legitimate files and leveraging features like script automation and file embedding.
Jun 29, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026
A new Stealit malware campaign has been identified by Fortinet’s FortiGuard Labs, targeting Microsoft Windows users through the abuse of Node.js’ Single Executable Application (SEA) feature. The campaign marks a shift from previous Stealit operations, which relied on the Electron framework to package and distribute malicious payloads. By utilizing the SEA feature, attackers can bundle all necessary scripts and assets into a single executable, allowing the malware to run on systems without a pre-installed Node.js runtime or additional dependencies. This approach increases the likelihood of successful infections, as it reduces the technical barriers for execution on victim machines. The malware is primarily distributed via fake installers for popular games and VPN applications, which are uploaded to widely used file-sharing platforms such as Mediafire and Discord. These installers are often disguised using PyInstaller and compressed archives to further evade detection. Once executed, the malware performs several anti-analysis checks, including detecting debuggers, virtual environments, and suspicious processes, terminating itself if such conditions are found. A notable technical detail is the writing of a Base64-encoded, 12-character authentication key to the %temp%\cache.json file, which is used for communication with the command-and-control (C2) server. The Stealit operation is run as a malware-as-a-service (MaaS), offering various subscription plans for its data extraction tools, including a remote access trojan (RAT) with capabilities such as file extraction, webcam control, live screen monitoring, and ransomware deployment. The service targets both Windows and Android platforms, with pricing tiers ranging from weekly to lifetime licenses. The operators have demonstrated operational security by frequently relocating their C2 infrastructure, moving from domains like stealituptaded.lol to iloveanimals.shop. The campaign’s impact is significant, as compromised machines fall under the control of the threat actors, who can exfiltrate sensitive information for use in further attacks. The campaign’s use of advanced obfuscation and anti-analysis techniques makes detection and mitigation more challenging for defenders. Organizations are advised to be vigilant against suspicious installers, especially those distributed via unofficial channels, and to monitor for indicators of compromise associated with Stealit. The campaign underscores the evolving tactics of cybercriminals in leveraging new software features and distribution methods to maximize reach and evade security controls. Security teams should update their detection mechanisms to account for Node.js SEA-based malware and educate users about the risks of downloading software from untrusted sources. The ongoing nature of the campaign and its professionalized service model highlight the persistent threat posed by MaaS operations in the current cyber threat landscape.
Jun 29, 2026