Loading story…
A new generation of information-stealing malware, or infostealers, is rapidly evolving, with tools like RedLine, Vidar, Lumma, and the newly identified SantaStealer enabling attackers to bypass traditional security controls. These infostealers are designed not just to steal credentials, but to capture session cookies, browser fingerprints, and sensitive files, allowing adversaries to impersonate users and access corporate resources even when strong passwords and multi-factor authentication are in place. The malware is often distributed via compromised personal or unmanaged devices, and the stolen data is commoditized in underground markets, fueling a thriving log economy where digital identities are bought and sold for further exploitation.
Recent research highlights the sophistication of new infostealer variants such as SantaStealer, which operates in-memory to evade detection, exfiltrates data in compressed chunks, and is actively marketed on underground forums. The industrialization of identity theft through these tools poses significant risks to organizations, as attackers can gain persistent access to sensitive systems and data. Security teams are urged to recognize that infostealers are not merely another malware category, but a critical threat vector that requires comprehensive detection, response, and user education strategies beyond simple credential resets or malware removal.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
An Infosec Writeups article described the broader ecosystem around infostealers such as RedLine, Vidar, and Lumma, emphasizing how stolen 'full logs' containing cookies, device fingerprints, credentials, and files are monetized in real time on Telegram channels. The piece highlighted gaming lures, cracked software, BYOD exposure, and the need for identity-focused defenses and proactive monitoring for leaked credentials.
Rapid7 Labs disclosed technical details on SantaStealer, including its in-memory design, browser and application theft modules, ChromeElevator-based browser decryption bypass, and exfiltration over unencrypted HTTP to hard-coded C2 servers. The report also published indicators of compromise such as sample hashes and C2 IP addresses, noting the actor's weak operational security.
Rapid7 reported that a new malware-as-a-service infostealer, SantaStealer, previously known as BluelineStealer, was being promoted on Telegram and underground forums with a planned release before the end of 2025. The service was advertised with affiliate pricing between $175 and $300 per month and targeting options including avoidance of CIS countries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Rapid7 have identified the re-emergence of SantaStealer, a malware-as-a-service infostealer that is being actively promoted on Telegram and hacker forums. SantaStealer is a rebranded version of the earlier BluelineStealer malware and is marketed as an in-memory malware designed to evade file-based detection. Despite claims of advanced stealth, analysis revealed that the malware is not particularly sophisticated, with leaked samples being easy to analyze and showing weak operational security. SantaStealer features 14 modular components capable of stealing browser data, credentials, cryptocurrency wallets, messaging app data, documents, and screenshots. The stolen data is archived in memory before being exfiltrated. The malware is offered via subscription, with prices set at $175 per month for basic access and $300 for premium. This resurgence highlights ongoing threats to digital asset security, particularly as infostealer malware continues to evolve and target cryptocurrency users and platforms.
Jun 29, 2026
Cybercriminals are actively marketing new information-stealing malware-as-a-service (MaaS) offerings on underground forums, with a focus on targeting credentials, browser data, and cryptocurrency wallets. The "MioLab MacOS" infostealer is being promoted as a resident macOS malware with a web-based control panel, customizable settings, and support for stealing data from over 200 crypto wallet extensions and more than 15 password managers, including Apple Keychain and LastPass. The malware is sold via a subscription model, with additional modules for hardware wallets like Ledger and Trezor, and is designed to appeal to cybercriminals seeking to compromise Apple devices and digital assets. Separately, "SantaStealer" is a new infostealer being advertised on Telegram and hacker forums, operating as a rebranded version of BluelineStealer. It is promoted for its in-memory operation to evade detection, though researchers note its current samples are not as stealthy as claimed. SantaStealer features a user-friendly affiliate panel, multiple data-theft modules, and flexible configuration options, allowing attackers to tailor payloads for specific data theft objectives. Both malware families exemplify the growing sophistication and commercialization of MaaS operations, lowering the barrier for cybercriminals to launch targeted credential and asset theft campaigns.
Jun 29, 2026
Threat researchers reported continued growth in the **infostealer** ecosystem, with new families emphasizing theft of browser credentials, session cookies, and cryptocurrency wallet data. Zscaler ThreatLabz detailed **Marco Stealer**, first observed in June 2025, which profiles infected hosts (e.g., OS version, hardware ID, IP/geolocation) and targets browser data plus cryptocurrency wallet information from browser extensions; it also searches for sensitive files in local and **cloud-synced** locations, including folders associated with *Dropbox* and *Google Drive*, and uses anti-analysis measures such as runtime string decryption. Separately, Cyfirma described **LTX Stealer**, a Windows-focused infostealer built around a bundled **Node.js runtime** and delivered via an Inno Setup installer (`Negro.exe`) that drops an unusually large (~271 MB) payload—reportedly to evade scanning heuristics. LTX Stealer targets Chromium-based browsers by extracting keys from `Local State` to decrypt saved passwords and cookies, collects screenshots, and stages data for exfiltration while using services such as *Supabase* (authentication) and *Cloudflare* (infrastructure masking). Flare’s research contextualized these developments as part of an “infostealer arms race,” observing multiple variants being marketed/updated across dark web forums and highlighting the downstream impact: analysis of **18.7M** infostealer logs (2025) found enterprise SSO/IdP credentials in more than 10% of infections, and Verizon DBIR data cited by Flare linked infostealer credential exposure to a significant share of ransomware victimization; Flare also noted stealer developers rapidly adapting to Chrome’s evolving credential protections (e.g., post-`v127` application-bound encryption and newer Chrome releases).
Jun 29, 2026