SvcStealer Steals Browser Credentials and Wallet Data via Phishing

Researchers identified SvcStealer as a new information-stealing malware family distributed through spear-phishing attachments and active since early 2025. Written in Microsoft Visual C++, the malware collects system details, installed software inventories, browser data, saved credentials, cryptocurrency wallet information, messaging app data, screenshots, and selected files before compressing the haul and exfiltrating it over HTTP POST traffic on port 80 to command-and-control infrastructure designed to blend in with normal web activity.

Analysis linked the malware to infrastructure including 176.113.115.149, 185.81.68.156, and the path /svcstealer/get.php, while reporting that some associated domains were unreachable during investigation. SvcStealer also uses anti-analysis and evasion techniques such as killing Task Manager and process inspection tools, enforcing a single running instance using a victim identifier derived from the host volume serial number, deleting traces after exfiltration, and downloading additional payloads for follow-on compromise; MalwareBazaar has tracked 125 related samples, with sightings extending into August 2026.