Loading story…
Researchers detailed multiple credential-theft threats targeting browsers, wallets, messaging apps, and copied secrets. Stealc, a malware-as-a-service infostealer marketed on Russian-speaking forums, was shown stealing browser credentials, cookies, autofill data, payment cards, cryptocurrency wallet extensions and files, Discord tokens, Telegram sessions, Steam files, Outlook credentials, and screenshots, while using anti-analysis checks, RC4-protected configuration data, and HTTP-based command-and-control to exfiltrate data and fetch second-stage payloads. Separately, Threatray linked the Rust-based Windows stealer KuinaExtractor to its newer k0to branding, finding the same malware family behind builds that steal browser data, saved credentials, gaming sessions, crypto-wallet data, Discord tokens, Windows Credential Manager data, and Wi-Fi details, while adding privilege-escalation attempts, Microsoft Defender tampering, and stronger concealment.
A parallel browser-based campaign used malicious updates to the Chrome extension "VPN Go: Free VPN" and the Firefox extension "Free VPN by VPN GO" to capture clipboard contents and send them to hardcoded HTTP endpoints. Because the extensions still provided visible VPN or proxy functionality, the clipboard theft was harder for users to spot, putting copied passwords, MFA recovery codes, seed phrases, API keys, OAuth tokens, and banking details at risk. The reports advised organizations to remove the extensions, review synced browser profiles, revoke sessions, rotate exposed credentials and secrets from a clean device, and treat any Windows system that executed the stealers as a full infostealer compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Two browser extensions, Chrome's "VPN Go: Free VPN" and Firefox's "Free VPN by VPN GO," were reported to have added clipboard-stealing functionality in later updates and exfiltrated copied data to hardcoded HTTP endpoints. Socket reported the extensions to Google and Mozilla and advised users to remove them and rotate exposed secrets.
Threatray's analysis connected KuinaExtractor and k0to through code similarity, mutexes, build paths, Telegram contact handles, and related experiments, concluding they are the same Rust-based infostealer family rather than separate threats.
A June 17, 2026 k0to build emphasized stealth over new theft capabilities, adding XOR-obfuscated strings, analyst-tool checks via PowerShell window titles, and a self-contained HTTP stack.
Stealc was sold as a Malware-as-a-Service on Russian-speaking underground forums starting in January 2023. The malware was attributed to a developer using the name Plymouth.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourcetrojan-killer.net
Open sourcefarghlymal.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as **VPN Go: Free VPN** initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version `1.1`, while the Firefox add-on first did so in version `1.3.3`, indicating a staged update strategy designed to retain users while covert theft ran in parallel. A separate campaign tracked as **Silent Swap** used unsigned installers to deploy a fake **Google Notes** Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using **EtherHiding** and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with **CountLoader**, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.
Jun 30, 2026
Threat researchers reported continued growth in the **infostealer** ecosystem, with new families emphasizing theft of browser credentials, session cookies, and cryptocurrency wallet data. Zscaler ThreatLabz detailed **Marco Stealer**, first observed in June 2025, which profiles infected hosts (e.g., OS version, hardware ID, IP/geolocation) and targets browser data plus cryptocurrency wallet information from browser extensions; it also searches for sensitive files in local and **cloud-synced** locations, including folders associated with *Dropbox* and *Google Drive*, and uses anti-analysis measures such as runtime string decryption. Separately, Cyfirma described **LTX Stealer**, a Windows-focused infostealer built around a bundled **Node.js runtime** and delivered via an Inno Setup installer (`Negro.exe`) that drops an unusually large (~271 MB) payload—reportedly to evade scanning heuristics. LTX Stealer targets Chromium-based browsers by extracting keys from `Local State` to decrypt saved passwords and cookies, collects screenshots, and stages data for exfiltration while using services such as *Supabase* (authentication) and *Cloudflare* (infrastructure masking). Flare’s research contextualized these developments as part of an “infostealer arms race,” observing multiple variants being marketed/updated across dark web forums and highlighting the downstream impact: analysis of **18.7M** infostealer logs (2025) found enterprise SSO/IdP credentials in more than 10% of infections, and Verizon DBIR data cited by Flare linked infostealer credential exposure to a significant share of ransomware victimization; Flare also noted stealer developers rapidly adapting to Chrome’s evolving credential protections (e.g., post-`v127` application-bound encryption and newer Chrome releases).
Jun 29, 2026
Proofpoint and Splunk report renewed activity tied to **Phantom Stealer**, a Windows infostealer linked to the broader **Stealerium** malware family, as threat actors expand phishing and malicious-download campaigns aimed at harvesting identities and credentials. Proofpoint observed campaigns attributed to **TA2715** and **TA2536** using lures themed around payments, court summons, donations, travel, hospitality, and adult content, delivered through compressed executables, JavaScript, VBScript, ISO/IMG, and ACE attachments. The malware family, derived from an open-source .NET codebase, has proliferated into overlapping variants including Phantom and Warp Stealer. Once executed, Phantom Stealer collects browser credentials, cookies, autofill data, session tokens, FTP and SSH client secrets, email client data, VPN configurations, cryptocurrency wallet information, and other files from compromised Windows systems. Reported behaviors include application enumeration, access to browser SQLite stores such as `Login Data`, `Cookies`, and `Web Data`, unauthorized reads of WinSCP configuration folders, registry run key or scheduled-task persistence, Wi-Fi reconnaissance, PowerShell-based Windows Defender exclusions, and in some variants abuse of Chrome remote debugging to bypass browser protections and steal active sessions. Stolen data has been archived and exfiltrated through encrypted channels and services including SMTP, Discord webhooks, Telegram, and GoFile, increasing the risk of account takeover, fraud, and follow-on enterprise compromise.
Jul 13, 2026