Loading story…
Researchers identified SvcStealer as a new information-stealing malware family distributed through spear-phishing attachments and active since early 2025. Written in Microsoft Visual C++, the malware collects system details, installed software inventories, browser data, saved credentials, cryptocurrency wallet information, messaging app data, screenshots, and selected files before compressing the haul and exfiltrating it over HTTP POST traffic on port 80 to command-and-control infrastructure designed to blend in with normal web activity.
Analysis linked the malware to infrastructure including 176.113.115.149, 185.81.68.156, and the path /svcstealer/get.php, while reporting that some associated domains were unreachable during investigation. SvcStealer also uses anti-analysis and evasion techniques such as killing Task Manager and process inspection tools, enforcing a single running instance using a victim identifier derived from the host volume serial number, deleting traces after exfiltration, and downloading additional payloads for follow-on compromise; MalwareBazaar has tracked 125 related samples, with sightings extending into August 2026.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Broadcom published a protection bulletin on SVCStealer describing its C++ infostealer behavior, including theft of credentials, browser data, cryptocurrency wallets, screenshots, messaging and VPN app data, and ZIP-based exfiltration to C2 servers. The bulletin also stated that Symantec and VMware Carbon Black detect or block the threat through behavioral, file-based, machine-learning, network-based, and web-based protections.
MalwareBazaar's SVCStealer signature entry shows its first seen alert timestamp on 2025-02-01 15:32:42 UTC, marking the earliest sample observation in that database entry.
Researchers reported that the SvcStealer information-stealing malware family was first observed in January 2025. Rewterz described it as newly identified, and Seqrite placed campaign activity at the end of that month.
The MalwareBazaar SVCStealer entry lists a last seen timestamp of 2026-08-10 15:00:23 UTC and reports 125 associated malware samples in the database.
Rewterz published a threat advisory describing SvcStealer's credential, browser, and cryptocurrency theft capabilities, HTTP POST exfiltration, and evasion techniques. The advisory also disclosed active indicators of compromise including IPs 185.81.68.156 and 176.113.115.149 and multiple file hashes.
Seqrite released a technical analysis of SvcStealer, detailing its spearphishing delivery, data theft and exfiltration behavior, C2 infrastructure, and follow-on payload capability. The report also published detections including TrojanSpy.SvcStealer.S35070558 and TjnSpy.SvcStealer.S35070557.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
bazaar.abuse.ch
Open sourcerewterz.com
Open sourcebroadcom.com
Open sourceseqrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Vanta Stealer**, a Python-based information-stealing malware for Windows that rapidly collects a wide range of data from infected systems. The malware is packaged with **PyInstaller** and obscured with multiple **PyArmor** layers, then uses a modular design that can download a dedicated browser extractor during execution. Reported targets include Chromium-based browsers, stored credentials, cookies, payment data, Discord tokens, Steam, Roblox, Riot Games, Valorant, Minecraft, Telegram Desktop, Mullvad VPN, cryptocurrency wallet files and recovery material, private documents, screenshots, and webcam images. After harvesting data, Vanta Stealer logs the results in `Summary.txt`, compresses the stolen files into a ZIP archive, and sends the archive with victim metadata to a predefined command-and-control endpoint over HTTP POST. Reporting on the malware said likely delivery methods include phishing attachments, fake installers, cheats, bogus software updates, tampered code repositories, and malicious search ads, and noted that defenders should watch for unusual archive uploads and restrict unapproved software while affected users reset passwords, revoke sessions, and review wallet exposure from a clean device.
Aug 6, 2026
Proofpoint and Splunk report renewed activity tied to **Phantom Stealer**, a Windows infostealer linked to the broader **Stealerium** malware family, as threat actors expand phishing and malicious-download campaigns aimed at harvesting identities and credentials. Proofpoint observed campaigns attributed to **TA2715** and **TA2536** using lures themed around payments, court summons, donations, travel, hospitality, and adult content, delivered through compressed executables, JavaScript, VBScript, ISO/IMG, and ACE attachments. The malware family, derived from an open-source .NET codebase, has proliferated into overlapping variants including Phantom and Warp Stealer. Once executed, Phantom Stealer collects browser credentials, cookies, autofill data, session tokens, FTP and SSH client secrets, email client data, VPN configurations, cryptocurrency wallet information, and other files from compromised Windows systems. Reported behaviors include application enumeration, access to browser SQLite stores such as `Login Data`, `Cookies`, and `Web Data`, unauthorized reads of WinSCP configuration folders, registry run key or scheduled-task persistence, Wi-Fi reconnaissance, PowerShell-based Windows Defender exclusions, and in some variants abuse of Chrome remote debugging to bypass browser protections and steal active sessions. Stolen data has been archived and exfiltrated through encrypted channels and services including SMTP, Discord webhooks, Telegram, and GoFile, increasing the risk of account takeover, fraud, and follow-on enterprise compromise.
Jul 13, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026