SnakeKeylogger and VIPKeylogger Campaigns Exposed by Open Dashboards and Leaked Credentials

Multiple phishing campaigns delivered SnakeKeylogger, VIPKeylogger, and Agent Tesla through layered infection chains that used obfuscated VBScript or PowerShell droppers, steganographic payload staging on Cloudinary, Internet Archive abuse, reflective in-memory .NET loading, and process hollowing into legitimate Windows binaries such as Caspol.exe, Aspnet_compiler.exe, and RegAsm.exe. One DHL-themed operation used a VIPKeylogger variant identified as a SnakeKeylogger rebrand, while a separate GuLoader campaign targeted Italian businesses with NSIS-wrapped stealers and business email compromise-style lures. Across the campaigns, the malware stole browser passwords, email and FTP credentials, Outlook and WinSCP secrets, Discord tokens, Wi-Fi passwords, screenshots, clipboard data, and keystrokes, then exfiltrated data over SMTP, Telegram, and FTP.

Investigators found repeated operator OPSEC failures that exposed active criminal infrastructure and victim data. A VIPKeylogger/SnakeKeylogger operator left a stock XAMPP dashboard and internet-accessible WinRM open on 144.172.105.88, while sandboxing captured plaintext SMTP credentials tied to result@miniorangeman.com on 185.196.9.150; although that C2 was taken offline shortly after detection, the Cloudinary-hosted payload and SMTP infrastructure reportedly remained live. In a separate GuLoader operation, an open FTP directory on holzbrenzii[.]com exposed 52 credential dumps from 27 victim machines in real time. Another SnakeKeylogger v4.4 campaign linked distinct droppers to the same backend through shared C2 strings, DDNS infrastructure, and staging artifacts, showing that technically capable malware operators repeatedly undermined their own campaigns by exposing panels, credentials, and stolen data.