Loading story…
Security researchers identified a campaign distributing the DeerStealer infostealer through fake Google Authenticator websites and a GitHub-hosted lure posing as a legitimate authenticator application. Broadcom reported that the malware is written in Delphi and is designed to steal confidential data from compromised endpoints before sending it to attacker-controlled command-and-control infrastructure.
The stolen data is exfiltrated as PKZIP archives, underscoring DeerStealer’s role as a credential and information theft threat rather than a disruptive payload. Separate tracking from MalwareBazaar shows the malware family has been observed in the wild across at least 83 samples, with sightings in its database spanning from 2025-04-18 11:46:54 UTC to 2026-06-15 16:47:37 UTC, indicating continued circulation after the campaign was first documented.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
MalwareBazaar recorded its first-seen alert for the DeerStealer malware family, marking the earliest sample in its database for this signature. The database entry later indicated 83 samples had been identified as DeerStealer.
MalwareBazaar recorded the last-seen timestamp for DeerStealer in the referenced dataset. This marked the most recent observed sample among the 83 DeerStealer samples listed in the database entry.
Broadcom reported a malicious campaign distributing the DeerStealer infostealer as a fake Google Authenticator application hosted in a GitHub repository. The malware was described as Delphi-based and capable of stealing confidential data and exfiltrating it to attacker-controlled servers as PKZIP archives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious WiX Burn bootstrapper branded as **"Antonomasia"** and signed to appear as publisher **"Cyme"** was used to deliver the **DeerStealer** malware-as-a-service infostealer while showing victims a legitimate copy of **Active@ Password Changer** as a decoy. Analysis found the bundle extracted 15 files from an embedded CAB archive, with the malicious chain centered on `Bichromate.dll`, an AES-CBC-encrypted payload stored as `jri`, and an XOR-obfuscated C2 configuration in `yodpxub`. `Bichromate.dll` masqueraded as Adobe's `CCMNative.dll` by repurposing Adobe Generic Download Engine code, then decrypted the configuration and payload and launched DeerStealer entirely in memory to reduce on-disk artifacts. Once executed, DeerStealer harvested credentials, cookies, browser session data, messaging and VPN information, FTP configurations, screenshots, and clipboard contents, while also targeting more than 50 browsers, over 14 cryptocurrency wallets, and roughly 800 browser extensions. The malware also enabled hidden VNC access and keylogging, and established persistence through an `HKCU\Run` key named `AppVTemplate` and scheduled tasks including `zceWriter`, `dyApp`, and `Pluginsecurity_dbg`. It communicated over HTTPS with Cloudflare-fronted command-and-control domains including `telluricaphelion[.]com` and `loadinnnhr[.]today`, and researchers assessed the operation as a social-engineering campaign likely spread through malvertising by an affiliate in the Rugmi/DeerStealer ecosystem.
Jun 29, 2026
**Collector Stealer**—also marketed as **COLLECTOR Project**, **CollectorGoomba**, and formerly **Memory Project**—was sold as a Russian-language spyware service and used to steal saved browser credentials, cookies, personal data, screenshots, Telegram and Steam data, and cryptocurrency wallet information from infected Windows systems. Researchers said the malware was spread through phishing portals, fake software downloads, and bundled crack or riskware tools such as **KMSAuto**, often disguised as miners, game utilities, or activation packages. On infected hosts, it gathered data from browsers and applications, captured screenshots, scanned directories, extracted SQLite-stored information, and staged the loot in **ZIP** or **RAR** archives before sending it to attacker-controlled panels over HTTP POST. Analysis of the malware’s infrastructure showed that some builds fetched their command-and-control destination from a text file hosted on **GitHub**, with a fallback to a hard-coded `justns.ru` subdomain if retrieval failed. After the malicious GitHub repository was reported and removed, affected samples attempted to exfiltrate to an invalid `404: Not Found.ru` destination and crashed, temporarily disrupting those variants. Operators later updated newer samples to use **upaste[.]me** for C2 redirection instead, indicating the stealer remained under active development and continued to evolve its exfiltration workflow and delivery ecosystem.
Aug 15, 2026
Breakglass Intelligence reported two malware delivery chains using **GhostPulse** to hide infostealer payloads inside fake PNG `IDAT` chunks and execute them through DLL sideloading with legitimate software. In one case, a 12.6 MB MSI installer dropped files into `%LOCALAPPDATA%\Coz\` and abused the EV-signed iMyFone Feedback binary `Utils.exe` by replacing `Qt5Network.dll` with a trojanized loader that parsed **752 headerless `IDAT` chunks** from concealed files to recover a **DeerStealer** payload and encrypted configuration. DeerStealer was described as a malware-as-a-service offering with tiers from **$200 to $3,000 per month**, supporting credential theft, browser and wallet targeting, hidden VNC, keylogging, clipper functions, and SmartScreen bypass. A second intrusion chain tied to the broader **ShadowLadder** campaign used a trojanized KMS activator distributed through a piracy-themed site and Box.com to install files under `%LocalAppData%\Eyalet\`, launch a legitimate Zoner Photo Studio binary, and sideload a malicious `sciter32.dll` that extracted encrypted content from local files using **238 fake `IDAT` chunks** before deploying **Rhadamanthys**. Researchers linked ShadowLadder to at least 35 samples used to spread multiple malware families, including Rhadamanthys, HijackLoader, ACRStealer, DeerStealer, and PeakLight, and identified infrastructure overlaps, Cloudflare-hosted domains, and OPSEC failures that point with medium confidence to a South Asian, possibly Indian, operator.
Jun 29, 2026