Loading story…
Security researchers at Rapid7 have identified the re-emergence of SantaStealer, a malware-as-a-service infostealer that is being actively promoted on Telegram and hacker forums. SantaStealer is a rebranded version of the earlier BluelineStealer malware and is marketed as an in-memory malware designed to evade file-based detection. Despite claims of advanced stealth, analysis revealed that the malware is not particularly sophisticated, with leaked samples being easy to analyze and showing weak operational security.
SantaStealer features 14 modular components capable of stealing browser data, credentials, cryptocurrency wallets, messaging app data, documents, and screenshots. The stolen data is archived in memory before being exfiltrated. The malware is offered via subscription, with prices set at $175 per month for basic access and $300 for premium. This resurgence highlights ongoing threats to digital asset security, particularly as infostealer malware continues to evolve and target cryptocurrency users and platforms.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
The UK government announced plans to fully regulate cryptocurrencies by 2027. The stated goal was to improve consumer protection and transparency in the sector.
Binance warned users about fraudulent listing agents claiming to influence token listings. The exchange said it had blacklisted seven entities and offered rewards for evidence of misconduct.
Researchers reported that SantaStealer had resurfaced as a malware-as-a-service infostealer and identified it as a rebranded version of BluelineStealer. Their analysis said the malware's advertised stealth capabilities were overstated and its operational security was weak.
Federal prosecutors expanded fraud and money laundering charges against Rodney Burton, also known as 'Bitcoin Rodney,' over his alleged role in the HyperFund crypto scheme. The scheme was described as involving about $1.8 billion.
Terraform Labs founder Do Kwon was sentenced to 15 years in prison for his role in the TerraUSD collapse. The case stems from the failure that wiped out roughly $40 billion from the crypto market.
Authorities seized the E-Note cryptocurrency platform, alleging it was used to launder more than $70 million in illicit proceeds. They also indicted alleged owner Mykhalio Petrovich Chudnovets in connection with the operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new information stealer known as SantaStealer has surfaced, posing a significant threat to Windows users by exfiltrating sensitive documents, credentials, and cryptocurrency wallet data. Marketed aggressively on Telegram and underground forums, SantaStealer is a rebranded version of BluelineStealer and is being offered as a malware-as-a-service (MaaS) platform with customizable modules. The malware operates entirely in memory to evade traditional detection, compresses stolen data into 10 MB chunks, and transmits it to command-and-control servers via unencrypted HTTP. Rapid7 researchers have analyzed samples of SantaStealer, revealing that despite claims of advanced anti-detection features, the malware contains operational security weaknesses, such as unstripped symbols and unencrypted strings, making it easier to analyze. SantaStealer's web panel allows threat actors to tailor the malware's configuration, including the ability to activate or deactivate up to 14 modules, integrate Telegram bot tokens for data exfiltration, and deploy fake error pages to distract victims. The MaaS is offered in basic and premium plans, with the latter including additional features like a crypto clipper and a polymorphic C engine. While the developers claim the malware is fully undetectable, security researchers have found it to be "ambitious but amateurish," with its final capabilities still under development. The emergence of SantaStealer highlights the ongoing evolution of the cybercrime ecosystem and the increasing sophistication of tools available to threat actors targeting sensitive user information.
Jun 29, 2026
Cybercriminals are actively marketing new information-stealing malware-as-a-service (MaaS) offerings on underground forums, with a focus on targeting credentials, browser data, and cryptocurrency wallets. The "MioLab MacOS" infostealer is being promoted as a resident macOS malware with a web-based control panel, customizable settings, and support for stealing data from over 200 crypto wallet extensions and more than 15 password managers, including Apple Keychain and LastPass. The malware is sold via a subscription model, with additional modules for hardware wallets like Ledger and Trezor, and is designed to appeal to cybercriminals seeking to compromise Apple devices and digital assets. Separately, "SantaStealer" is a new infostealer being advertised on Telegram and hacker forums, operating as a rebranded version of BluelineStealer. It is promoted for its in-memory operation to evade detection, though researchers note its current samples are not as stealthy as claimed. SantaStealer features a user-friendly affiliate panel, multiple data-theft modules, and flexible configuration options, allowing attackers to tailor payloads for specific data theft objectives. Both malware families exemplify the growing sophistication and commercialization of MaaS operations, lowering the barrier for cybercriminals to launch targeted credential and asset theft campaigns.
Jun 29, 2026
A new generation of information-stealing malware, or infostealers, is rapidly evolving, with tools like RedLine, Vidar, Lumma, and the newly identified SantaStealer enabling attackers to bypass traditional security controls. These infostealers are designed not just to steal credentials, but to capture session cookies, browser fingerprints, and sensitive files, allowing adversaries to impersonate users and access corporate resources even when strong passwords and multi-factor authentication are in place. The malware is often distributed via compromised personal or unmanaged devices, and the stolen data is commoditized in underground markets, fueling a thriving log economy where digital identities are bought and sold for further exploitation. Recent research highlights the sophistication of new infostealer variants such as SantaStealer, which operates in-memory to evade detection, exfiltrates data in compressed chunks, and is actively marketed on underground forums. The industrialization of identity theft through these tools poses significant risks to organizations, as attackers can gain persistent access to sensitive systems and data. Security teams are urged to recognize that infostealers are not merely another malware category, but a critical threat vector that requires comprehensive detection, response, and user education strategies beyond simple credential resets or malware removal.
Jun 29, 2026