Loading story…
Proofpoint reported that Nocturnal Stealer, a low-cost information-stealing malware sold on an underground forum for 1,500 Rubles (about $25), was observed being deployed in the wild by an unknown loader. The malware targets Chromium- and Firefox-based browsers, cryptocurrency wallets, and FileZilla FTP credentials, harvesting stored usernames, passwords, cookies, autofill data, payment card details, wallet information, and host system data.
The stealer stages stolen data locally and exfiltrates it to a command-and-control server over HTTP POST requests using the User-Agent string Nocturnal/1.0. Proofpoint said the malware includes basic anti-analysis features, including anti-VM checks, queries ip-api.com to identify the victim's external IP address and country code, and deletes dropped files after sending the data. Researchers assessed the malware as relatively unsophisticated, but warned that its low price and broad credential theft capabilities make it accessible to low-skill criminals and potentially damaging at scale.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Proofpoint publicly documented Nocturnal Stealer's capabilities, including browser credential theft, wallet targeting, anti-VM checks, use of ip-api.com for host profiling, and cleanup behavior after exfiltration. The company assessed it as relatively unsophisticated but still potentially harmful due to its low cost and broad monetization potential.
Proofpoint observed Nocturnal Stealer being dropped in real-world infections by an unknown loader. The malware targeted Chromium- and Firefox-based browsers, cryptocurrency wallets, and FileZilla FTP credentials, then exfiltrated stolen data to a command-and-control server via HTTP POST.
A malware called Nocturnal Stealer was advertised for sale on an underground forum for 1,500 Rubles, about US$25 at the time. The low price positioned it as inexpensive commodity information-stealing malware accessible to low-skill cybercriminals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that **Ovidiy Stealer**, a previously undocumented credential-theft malware family, was being actively sold and used in the wild, primarily in Russian-speaking cybercrime markets. The malware was advertised as a low-cost, modular tool and was observed in multiple rapidly updated versions, including `1.0.1` through `1.0.5`, suggesting active development and broad accessibility for lower-skilled threat actors. Ovidiy Stealer was distributed through malicious email attachments, direct executable downloads, and software-lure bundles such as fake installers. Once executed, it harvested credentials from web browsers and **FileZilla** and exfiltrated the data over **SSL/TLS** to the command-and-control domain `ovidiystealer[.]ru`. Proofpoint said the malware lacked persistence and stayed in its installation directory, appeared to reuse code from the open-source **LiteHTTP Bot** project, and was allegedly authored by an actor using the handle **"TheBottle"**, with the same domain serving both as the malware sales portal and operational C2 infrastructure.
Aug 14, 2026
Researchers reported that **BloodyStealer**, a low-cost information-stealing malware sold on a Russian-speaking underground forum, was being used to harvest browser data, system details, and active sessions from gaming and messaging platforms. The malware specifically targeted services including **Steam, Origin, Epic Games, GOG, Bethesda, Telegram, and VimeWorld**, and used anti-analysis features, victim fingerprinting, command-and-control communications, and ZIP-based data exfiltration to steal data from infected systems. The stolen data fed a broader criminal marketplace where gaming logs, compromised accounts, in-game items, and phishing kits were bought and sold for profit. Researchers said the malware appeared in multistage infection chains alongside threats such as **KeyBase** and **Agent Tesla**, with detections across Europe, Latin America, and APAC, primarily affecting home users as attackers monetized virtual goods, account access, and gaming-related credentials through wholesale and retail underground sales.
Aug 15, 2026
**Collector Stealer**—also marketed as **COLLECTOR Project**, **CollectorGoomba**, and formerly **Memory Project**—was sold as a Russian-language spyware service and used to steal saved browser credentials, cookies, personal data, screenshots, Telegram and Steam data, and cryptocurrency wallet information from infected Windows systems. Researchers said the malware was spread through phishing portals, fake software downloads, and bundled crack or riskware tools such as **KMSAuto**, often disguised as miners, game utilities, or activation packages. On infected hosts, it gathered data from browsers and applications, captured screenshots, scanned directories, extracted SQLite-stored information, and staged the loot in **ZIP** or **RAR** archives before sending it to attacker-controlled panels over HTTP POST. Analysis of the malware’s infrastructure showed that some builds fetched their command-and-control destination from a text file hosted on **GitHub**, with a fallback to a hard-coded `justns.ru` subdomain if retrieval failed. After the malicious GitHub repository was reported and removed, affected samples attempted to exfiltrate to an invalid `404: Not Found.ru` destination and crashed, temporarily disrupting those variants. Operators later updated newer samples to use **upaste[.]me** for C2 redirection instead, indicating the stealer remained under active development and continued to evolve its exfiltration workflow and delivery ecosystem.
Aug 15, 2026