Loading story…
Storm is a newly advertised infostealer sold as a subscription-based cybercrime service that steals browser credentials, cookies, refresh tokens, cryptocurrency wallet data, documents, messaging app session data, screenshots, and system information. Reporting indicates it targets Chromium and Gecko-based browsers, including Chrome, Edge, Firefox, and Waterfox, while also going after services and apps such as Telegram, Discord, Binance, and Coinbase. Investigators observed victim logs spanning multiple countries, including India, Brazil, the United States, and the United Kingdom, and a criminal panel showing more than 1,700 log entries.
The malware’s distinguishing feature is server-side decryption, which allows stolen browser data to be exfiltrated in encrypted form and decrypted on attacker-controlled infrastructure rather than on the victim device. That design reduces endpoint telemetry, helps evade antivirus detection, and reportedly undermines Chrome’s App-Bound Encryption protections. Storm also includes automated cookie restoration and the use of geographically matched SOCKS5 proxies to re-establish authenticated sessions, enabling attackers to bypass password-based defenses and, in some cases, render MFA ineffective while accessing SaaS accounts, Microsoft 365, internal tools, and cloud environments.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
SC Media amplified Varonis' findings, emphasizing that Storm undermines Google's App-Bound Encryption introduced in Chrome 127 and targets browsers such as Chrome, Edge, Firefox, and Waterfox. The coverage also noted Storm's theft of crypto wallet and messaging app data and its ability to capture screenshots.
Varonis published research describing Storm's ability to steal browser credentials, cookies, refresh tokens, crypto wallet data, messaging app session data, screenshots, and system information, then exfiltrate encrypted data for server-side decryption. The report highlighted that Storm supports Chromium and Gecko-based browsers and can restore stolen cookies to hijack authenticated sessions, potentially bypassing password protections and some MFA controls.
At the time of Varonis Threat Labs' investigation, Storm's panel reportedly showed 1,715 log entries affecting users across multiple countries, including India, Brazil, the United States, and the United Kingdom. This indicated the malware was already being used in active credential and session theft operations.
Storm, a new subscription-based infostealer service, was advertised on underground cybercrime forums in early 2026. It was marketed in multiple tiers and designed for multi-user criminal operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google introduced **Application-Bound Encryption** in Chrome 127 for Windows to reduce browser-cookie theft by malware running as the logged-in user. The protection routes decryption through a privileged service that validates Chrome’s application identity, replacing reliance on DPAPI alone and raising the bar for attackers to obtain SYSTEM privileges or inject code into Chrome. Google began the migration with cookies and plans to extend it to passwords, payment data, and other persistent authentication tokens. Infostealer families including **STEALC/VIDAR**, **MetaStealer**, **Phemedrone**, **XenoStealer**, and **Lumma** adapted by scraping plaintext cookies from Chrome process memory, abusing the Chrome elevation service through COM, injecting into browser processes, or enabling Chrome remote debugging to recover session tokens. Subsequent Hannibal Stealer research also examined the contest between browser protections and credential-stealing malware. Defenders can detect these bypasses through anomalous Chrome child-process activity, memory access, access to cookie files or elevation-service registry keys, localhost debugging traffic, and untrusted code placed in Chrome application directories.
Sep 9, 2026
Threat researchers reported continued growth in the **infostealer** ecosystem, with new families emphasizing theft of browser credentials, session cookies, and cryptocurrency wallet data. Zscaler ThreatLabz detailed **Marco Stealer**, first observed in June 2025, which profiles infected hosts (e.g., OS version, hardware ID, IP/geolocation) and targets browser data plus cryptocurrency wallet information from browser extensions; it also searches for sensitive files in local and **cloud-synced** locations, including folders associated with *Dropbox* and *Google Drive*, and uses anti-analysis measures such as runtime string decryption. Separately, Cyfirma described **LTX Stealer**, a Windows-focused infostealer built around a bundled **Node.js runtime** and delivered via an Inno Setup installer (`Negro.exe`) that drops an unusually large (~271 MB) payload—reportedly to evade scanning heuristics. LTX Stealer targets Chromium-based browsers by extracting keys from `Local State` to decrypt saved passwords and cookies, collects screenshots, and stages data for exfiltration while using services such as *Supabase* (authentication) and *Cloudflare* (infrastructure masking). Flare’s research contextualized these developments as part of an “infostealer arms race,” observing multiple variants being marketed/updated across dark web forums and highlighting the downstream impact: analysis of **18.7M** infostealer logs (2025) found enterprise SSO/IdP credentials in more than 10% of infections, and Verizon DBIR data cited by Flare linked infostealer credential exposure to a significant share of ransomware victimization; Flare also noted stealer developers rapidly adapting to Chrome’s evolving credential protections (e.g., post-`v127` application-bound encryption and newer Chrome releases).
Jun 29, 2026
Researchers reported a new macOS infostealer, **AmnesiaStealer**, being spread through **ClickFix-style** social engineering that tricks users into copying and pasting a malicious command into Terminal, including via fake GitHub download pages. The multi-stage infection chain uses a Bash loader to profile the host and retrieve a processor-specific Mach-O payload written in Go, then steals browser passwords, Apple Keychain data, cached credentials, Telegram sessions, Apple Notes, documents, and other sensitive information from infected systems. Investigators said the malware also includes cryptocurrency-theft functionality that can transfer wallet funds to attacker-controlled addresses, and a later-stage component, `stream_module`, can be fetched on demand to clone browser profiles and attach to the Chrome DevTools Protocol for covert access to already authenticated browser sessions. Huntress linked parts of the loader, payload-hosting, and command-and-control infrastructure to the **Aeza Group**, a sanctioned Russian bulletproof hosting provider tied to cybercrime, while Jamf noted some privacy-bypass methods are outdated on newer macOS releases even though the malware’s credential theft and session-hijacking features remain effective.
Aug 24, 2026