Loading story…
Security reports say the TAMECAT PowerShell-based backdoor is being used to harvest saved login credentials from Microsoft Edge and Google Chrome. The malware is described as targeting browser-stored usernames and passwords, putting enterprise and personal accounts at risk if infected systems are compromised.
Coverage across multiple security outlets identifies TAMECAT as a credential-theft backdoor built around PowerShell, highlighting its ability to exfiltrate sensitive browser data from widely used Chromium-based browsers. The activity underscores the continued use of native scripting tools for stealthy post-compromise access and data theft, with browser credential stores remaining a high-value target for attackers seeking account takeover and broader network intrusion.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Multiple reports disclosed the TAMECAT PowerShell-based backdoor as malware capable of stealing login credentials from Microsoft Edge and Google Chrome. The references do not provide a more specific event date beyond the publication day.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cyberpress.org
Open sourcegbhackers.com
Open sourcemalwaretips.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **TASK#STOMP**, a VBScript-led, PowerShell-based Windows backdoor built for corporate espionage. The malware inventories and exfiltrates business documents, watches for newly created or modified files, steals saved Wi-Fi passwords and clipboard contents, captures screenshots and system metadata, and allows operators to run arbitrary PowerShell commands. Its components communicate with redundant command-and-control domains using a hardcoded authentication token. TASK#STOMP maintains access through four masquerading scheduled tasks and a Startup-folder script, with two PowerShell components configured to monitor one another; partial remediation may therefore permit reinfection. The malware also uses hidden execution, timestomping, native Windows utilities, process control, and cleanup mechanisms to frustrate detection and forensic analysis. Researchers observed an Iranian government-tender website opened in Chrome by the orchestrator, though its purpose is unknown; the campaign's delivery method, scope, duration, and responsible actor remain unconfirmed.
Sep 23, 2026
Proofpoint and Splunk report renewed activity tied to **Phantom Stealer**, a Windows infostealer linked to the broader **Stealerium** malware family, as threat actors expand phishing and malicious-download campaigns aimed at harvesting identities and credentials. Proofpoint observed campaigns attributed to **TA2715** and **TA2536** using lures themed around payments, court summons, donations, travel, hospitality, and adult content, delivered through compressed executables, JavaScript, VBScript, ISO/IMG, and ACE attachments. The malware family, derived from an open-source .NET codebase, has proliferated into overlapping variants including Phantom and Warp Stealer. Once executed, Phantom Stealer collects browser credentials, cookies, autofill data, session tokens, FTP and SSH client secrets, email client data, VPN configurations, cryptocurrency wallet information, and other files from compromised Windows systems. Reported behaviors include application enumeration, access to browser SQLite stores such as `Login Data`, `Cookies`, and `Web Data`, unauthorized reads of WinSCP configuration folders, registry run key or scheduled-task persistence, Wi-Fi reconnaissance, PowerShell-based Windows Defender exclusions, and in some variants abuse of Chrome remote debugging to bypass browser protections and steal active sessions. Stolen data has been archived and exfiltrated through encrypted channels and services including SMTP, Discord webhooks, Telegram, and GoFile, increasing the risk of account takeover, fraud, and follow-on enterprise compromise.
Jul 13, 2026
Threat actors and malware are continuing to harvest credentials from files, configuration stores, and application artifacts on compromised systems, a technique tracked as **MITRE ATT&CK `T1552.001`**. Common targets include browser password stores, email and chat clients, FTP/VPN/SSH tools, cloud credential files, and infrastructure secrets such as Docker or Kubernetes tokens. MITRE’s mappings show groups including **Fox Kitten** and **FIN13** combining this activity with broader credential theft such as **LSASS** dumping, **NTDS.dit** extraction, registry hive theft, and collection of KeePass databases after gaining access through exploited public-facing applications, VPN appliances, remote services, or default credentials. Defenders are also tracking this behavior in enterprise tools that store access secrets locally. Splunk published a Windows analytic that flags **Security Event ID `4663`** when any process other than `winscp.exe` accesses the WinSCP configuration security folder, which may contain SSH and FTP credentials, passwords, and private key references. The detection is intended to catch possible credential theft, including activity linked to information stealers such as **Phantom Stealer**, and Splunk advises investigators to review the accessing process, its parent process, and related network activity while accounting for benign access from backup or antivirus software.
Jul 13, 2026