Snake Keylogger Uses Macro Loaders and Multi-Stage .NET Theft Chains

Researchers detailed how Snake Keylogger—also tracked as 404 Keylogger—continues to spread through multi-stage infection chains that begin with phishing documents or other loaders and end in credential theft, surveillance, and data exfiltration. One analyzed campaign used a malicious Microsoft Word file with VBA macros that dropped an .inf file into %TEMP% and abused LaunchINFSectionW from Advpack.dll to execute the next stage through legitimate Windows components. That chain then used built-in tools to reconstruct and launch a disguised DLL downloader, which attempted to fetch an additional payload from a remote command-and-control endpoint.

Separate technical analyses describe Snake as a long-running malware-as-a-service operation with modular .NET payloads, in-memory decryption, steganographic extraction of components, and execution techniques including process injection and process hollowing. The malware is designed to steal browser, email, FTP, Discord, and Wi-Fi credentials; log keystrokes; capture screenshots and clipboard data; profile infected hosts; and evade analysis through anti-debugging checks and termination of security tools. Researchers also reported persistence through registry keys, startup items, or scheduled tasks, and exfiltration over channels including Telegram, SMTP, and FTP, while linking the family to variants such as Matiex, Cheetah, and Nova.