Loading story…
Researchers uncovered a newly identified malware-as-a-service operation called Evil Stealer after its backend infrastructure was left exposed on Njalla-hosted systems, including an unauthenticated status API on port 8888 and a raw Next.js panel on port 3000. The exposed API revealed a sequential counter showing 310,194 processed credential logs within roughly six days, while the panel’s JavaScript also contained a cryptocurrency wallet drainer. Investigators linked the operation to domains including evilmirror[.]net and ofmhubintel[.]com, the latter tied to an OnlyFans creator scraper, indicating the actor was pursuing multiple monetization streams beyond credential theft.
The operator was identified with high confidence through poor operational security in a promotional video whose unstripped XMP metadata exposed the Windows username "moros", a Russian-language filename, and timestamps consistent with UTC+3 / Moscow time. Additional artifacts, including Russian keyboard indicators, shared registrar and hosting details, matching SSH HASSH fingerprints, and common Ubuntu templates, supported the assessment that the same Russian-speaking actor ran the linked infrastructure. Researchers also observed nearby suspicious services on the same hosting environment, including phishing and TLS interception infrastructure, although attribution for those adjacent systems was weaker; the malware payload and delivery chain for Evil Stealer itself had not yet been publicly identified.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
A social media post preview on May 8, 2026 referenced analysis of the Needle crypto-stealer stating that a plaintext API key embedded in the Rust malware exposed access to data on 1,932 victims and revealed the operator's withdrawal configuration. The available source is limited to the post title and does not include the underlying technical report.
On March 13, 2026, Breakglass expanded its reporting, detailing the exposed raw Next.js server on port 3000, bare Python monitoring endpoint on port 8888, and metadata in the promotional video that supported a Russian-speaking, UTC+3 operator assessment.
The same March 12 reporting said the operation combined multiple monetization streams: an infostealer, a cryptocurrency wallet drainer embedded in panel JavaScript, and a linked OnlyFans scraper branded OFM Hub Intel.
On March 12, 2026, Breakglass disclosed the newly identified Evil Stealer operation and attributed it with high confidence to an operator using the Windows username "moros," based on unstripped XMP metadata and Russian-language artifacts.
Within roughly six days of setup, Evil Stealer's unauthenticated status API on port 8888 revealed a sequential counter showing 310,194 processed credential logs, though investigators noted the count may have been frozen or migrated from earlier data.
Breakglass found a Candy Crush-themed StealC v2 binary communicating with live C2 domain joscramp[.]top on Google Cloud IP 34.41.139.193, and reported the server remained operational as of 2026-03-09.
A StealC v2 sample later analyzed by Breakglass was uploaded to MalwareBazaar on 2026-03-09, providing the basis for subsequent clustering and infrastructure analysis.
On March 4, 2026, infrastructure for Evil Stealer was rapidly established, including registration of evilmirror[.]net, issuance of a Let's Encrypt certificate, and deployment of a promotional video.
Breakglass reported that the StealC operator or affiliate had reused the same gate path and related infrastructure since at least March 2023, indicating the start of a longer-running financially motivated crime operation.
Developer fingerprints such as the copyright string "shmaer," product metadata, and recurring PDB path patterns linked 19 related binaries across StealC, RedLine Stealer, and Rhadamanthys dating back to 2023.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 110 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzing multiple **Vidar Stealer** samples found the malware relies heavily on encrypted or XOR-obfuscated strings and dynamic API resolution to conceal its behavior. Reverse engineering with **Ghidra** and **x32dbg** exposed decrypted strings tied to `LoadLibraryA`, `GetProcAddress`, `VirtualAlloc`, anti-analysis checks, and broad data-theft functions. The recovered functionality shows Vidar harvesting browser passwords, cookies, autofill data, credit cards, Firefox/NSS secrets, FileZilla and WinSCP data, Steam files, Discord and Telegram artifacts, screenshots, host metadata, and numerous desktop and browser-extension cryptocurrency wallets. A separate campaign analysis showed Vidar configured to treat some stolen data differently when credentials were associated with hostnames linked to government, military, police, intelligence, CERT, and NATO-related organizations in Poland and the Baltic region. In that sample, the malware decrypted a hardcoded hostname list, checked stolen credentials for matches, and redirected matching data to an alternate command-and-control path, while command-and-control addresses were retrieved from Mastodon profiles including **@oleg98** and **@artemida**. The reporting also linked the broader activity to infrastructure or samples associated with **Raccoon**, **RedLine Stealer**, **SmokeLoader**, and **STOP ransomware**, indicating a wider criminal ecosystem around the campaign.
Aug 15, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026