Stealc and k0to Infostealers Expand Credential Theft as VPN Extensions Hijack Clipboards

Researchers detailed multiple credential-theft threats targeting browsers, wallets, messaging apps, and copied secrets. Stealc, a malware-as-a-service infostealer marketed on Russian-speaking forums, was shown stealing browser credentials, cookies, autofill data, payment cards, cryptocurrency wallet extensions and files, Discord tokens, Telegram sessions, Steam files, Outlook credentials, and screenshots, while using anti-analysis checks, RC4-protected configuration data, and HTTP-based command-and-control to exfiltrate data and fetch second-stage payloads. Separately, Threatray linked the Rust-based Windows stealer KuinaExtractor to its newer k0to branding, finding the same malware family behind builds that steal browser data, saved credentials, gaming sessions, crypto-wallet data, Discord tokens, Windows Credential Manager data, and Wi-Fi details, while adding privilege-escalation attempts, Microsoft Defender tampering, and stronger concealment.

A parallel browser-based campaign used malicious updates to the Chrome extension "VPN Go: Free VPN" and the Firefox extension "Free VPN by VPN GO" to capture clipboard contents and send them to hardcoded HTTP endpoints. Because the extensions still provided visible VPN or proxy functionality, the clipboard theft was harder for users to spot, putting copied passwords, MFA recovery codes, seed phrases, API keys, OAuth tokens, and banking details at risk. The reports advised organizations to remove the extensions, review synced browser profiles, revoke sessions, rotate exposed credentials and secrets from a clean device, and treat any Windows system that executed the stealers as a full infostealer compromise.