Loading story…
Threat actors and malware are continuing to harvest credentials from files, configuration stores, and application artifacts on compromised systems, a technique tracked as MITRE ATT&CK T1552.001. Common targets include browser password stores, email and chat clients, FTP/VPN/SSH tools, cloud credential files, and infrastructure secrets such as Docker or Kubernetes tokens. MITRE’s mappings show groups including Fox Kitten and FIN13 combining this activity with broader credential theft such as LSASS dumping, NTDS.dit extraction, registry hive theft, and collection of KeePass databases after gaining access through exploited public-facing applications, VPN appliances, remote services, or default credentials.
Defenders are also tracking this behavior in enterprise tools that store access secrets locally. Splunk published a Windows analytic that flags Security Event ID 4663 when any process other than winscp.exe accesses the WinSCP configuration security folder, which may contain SSH and FTP credentials, passwords, and private key references. The detection is intended to catch possible credential theft, including activity linked to information stealers such as Phantom Stealer, and Splunk advises investigators to review the accessing process, its parent process, and related network activity while accounting for benign access from backup or antivirus software.
Get the actors, campaigns, and ATT&CK mapping behind it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint and Splunk report renewed activity tied to **Phantom Stealer**, a Windows infostealer linked to the broader **Stealerium** malware family, as threat actors expand phishing and malicious-download campaigns aimed at harvesting identities and credentials. Proofpoint observed campaigns attributed to **TA2715** and **TA2536** using lures themed around payments, court summons, donations, travel, hospitality, and adult content, delivered through compressed executables, JavaScript, VBScript, ISO/IMG, and ACE attachments. The malware family, derived from an open-source .NET codebase, has proliferated into overlapping variants including Phantom and Warp Stealer. Once executed, Phantom Stealer collects browser credentials, cookies, autofill data, session tokens, FTP and SSH client secrets, email client data, VPN configurations, cryptocurrency wallet information, and other files from compromised Windows systems. Reported behaviors include application enumeration, access to browser SQLite stores such as `Login Data`, `Cookies`, and `Web Data`, unauthorized reads of WinSCP configuration folders, registry run key or scheduled-task persistence, Wi-Fi reconnaissance, PowerShell-based Windows Defender exclusions, and in some variants abuse of Chrome remote debugging to bypass browser protections and steal active sessions. Stolen data has been archived and exfiltrated through encrypted channels and services including SMTP, Discord webhooks, Telegram, and GoFile, increasing the risk of account takeover, fraud, and follow-on enterprise compromise.
Jul 13, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Security researchers highlighted multiple Windows credential exposure paths that can hand attackers plaintext passwords without requiring noisy `LSASS` dumping. Common sources include PowerShell command history stored in `ConsoleHost_History.txt`, plaintext files and stealer logs, exposed Active Directory attributes, and legacy Group Policy Preferences (`GPP`) XML files in `SYSVOL` that may still contain decryptable `cpassword` values accessible to authenticated domain users. The reporting also described more persistent credential-harvesting techniques that abuse legitimate Windows authentication components, including malicious Security Support Providers, password filter DLLs, and network provider DLLs to capture credentials during logon or password changes. Defenders were urged to remove vulnerable `GPP` artifacts, deploy protections such as Microsoft's `LAPS`, audit systems for exposed secrets and suspicious registry or file changes, and monitor for abuse of PowerShell history and authentication-related components with tools such as Sysmon.
Aug 1, 2026