SolyxImmortal Python Info-Stealer Abusing Discord Webhooks for Data Exfiltration
Malware Intelligence · 3 sources · Updated 4mo ago · First seen Jan 20, 2026
Threat researchers reported a new Python-based Windows information-stealing malware dubbed SolyxImmortal that emphasizes stealth and long-term persistence over destructive actions. The implant is described as a “monolithic” package (not modular), delivered as a legitimate-looking Python script (e.g., Lethalcompany.py), and runs quietly in the background to harvest sensitive data including credentials, documents, keystrokes, and screenshots.
SolyxImmortal’s command-and-control and exfiltration model relies on Discord webhooks, abusing trusted HTTPS traffic to blend in and reduce network-based detection. Reporting attributes the analysis to CYFIRMA, noting that C2 parameters are hardcoded and that operators can receive real-time notifications (including via a hardcoded Discord user ID) for high-value events; separate webhooks may be used for different data types (e.g., logs/files vs. screenshots). The malware targets browser-stored data (including Chromium-based browsers such as Chrome, Edge, Brave, and Opera GX) and focuses on single-host surveillance rather than lateral movement.
