Loading story…
Researchers reported that MassLogger, a .NET credential-stealing malware sold on criminal forums, has evolved from heavily obfuscated loader-based campaigns into a more stealthy fileless variant that stores staged payloads in the Windows Registry and executes them in memory. Seqrite said recent infections begin with a .VBE loader, progress through multiple .NET stagers, and ultimately inject the final payload into AddInProcess32.exe via process hollowing while maintaining persistence through a scheduled task. The malware can also check for installed security products and stop execution when multiple antivirus tools are present, adding another layer of defense evasion.
Analysis across multiple reports shows MassLogger consistently focuses on credential theft while using increasingly sophisticated anti-analysis techniques. Avast previously documented version 3 using encrypted configuration blobs, PBKDF2-derived keys, AES decryption, SHA-256 integrity checks, encrypted strings, and a large custom interpreter to conceal control flow, while newer samples avoid writing stolen data to disk. Related loader research found the ReZer0 .NET loader supports anti-VM and anti-sandbox checks, scheduled-task persistence, in-memory assembly loading, download-and-run behavior, and process hollowing. Seqrite added that the latest fileless variant can steal browser and email credentials, log keystrokes, capture clipboard data, collect host information, and exfiltrate data through FTP, SMTP, or Telegram, with one France-targeted branch attempting to fetch an additional payload from hxxps://144.91.92.251/MoDi.txt.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Seqrite Labs identified and analyzed a fileless MassLogger variant delivered through .VBE files that stores staged payloads in the Windows Registry and executes them in memory. The infection chain used VBScript and .NET stagers, established persistence with a scheduled task, and hollowed AddInProcess32.exe to run the final payload.
Avast published a technical analysis of MassLogger v3 describing its layered obfuscation, encrypted configuration handling, and interpreter-based execution. The analysis also noted newer variants refuse to run when Avast or AVG processes are detected and no longer write log data to disk.
Cisco Talos disclosed a credential-stealing campaign using a MassLogger variant delivered via phishing emails with .chm attachments, targeting Windows users in Turkey, Latvia, and Italy, with related 2020 waves also hitting several other European countries. Talos said the attack chain was almost entirely fileless after the initial attachment and that stolen credentials were exfiltrated over FTP to med-star.gr.
G DATA published a technical analysis of MassLogger describing it as a modular .NET credential stealer and spyware sold on hacker forums and promoted via YouTube videos. The analyzed sample used multiple packing stages and dnSpy detection, executed in memory with process injection, harvested credentials, could capture screenshots, and exfiltrated stolen data over SMTP while also supporting FTP.
MassLogger was first sold on hacking forums around April 2020 as a configurable credential theft and keylogging tool. The malware author advertised it as the “most powerful logger and recovery tool” and offered a lifetime license for $99 in Bitcoin.
Seqrite published an analysis of a 2020 MassLogger campaign distributed through malicious spam attachments, including archives and Office documents using VBA macros and CVE-2017-11882 to fetch the payload. The report detailed a multi-stage .NET infection chain with scheduled-task persistence, self-hollowing, data theft modules, and ZIP-based exfiltration of stolen information.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 263 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
seqrite.com
Open sourcedecoded.avast.io
Open sourceblog.talosintelligence.com
Open sourceseqrite.com
Open sourcegdatasoftware.com
Open sourcemaxkersten.nl
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers detailed how **Snake Keylogger**—also tracked as **404 Keylogger**—continues to spread through multi-stage infection chains that begin with phishing documents or other loaders and end in credential theft, surveillance, and data exfiltration. One analyzed campaign used a malicious Microsoft Word file with VBA macros that dropped an `.inf` file into `%TEMP%` and abused `LaunchINFSectionW` from `Advpack.dll` to execute the next stage through legitimate Windows components. That chain then used built-in tools to reconstruct and launch a disguised DLL downloader, which attempted to fetch an additional payload from a remote command-and-control endpoint. Separate technical analyses describe Snake as a long-running **malware-as-a-service** operation with modular .NET payloads, in-memory decryption, steganographic extraction of components, and execution techniques including process injection and process hollowing. The malware is designed to steal browser, email, FTP, Discord, and Wi-Fi credentials; log keystrokes; capture screenshots and clipboard data; profile infected hosts; and evade analysis through anti-debugging checks and termination of security tools. Researchers also reported persistence through registry keys, startup items, or scheduled tasks, and exfiltration over channels including **Telegram**, **SMTP**, and **FTP**, while linking the family to variants such as **Matiex**, **Cheetah**, and **Nova**.
Jul 13, 2026
Researchers reported continued evolution in two prominent malware loaders used for financially motivated intrusions: **SocGholish** and **BLISTER**. Elastic said newer BLISTER variants hide malicious code inside legitimate DLLs, including **VLC Media Player** libraries, and add stronger evasion such as domain-based environmental keying, configurable anti-debugging, revised configuration fields, and unhooking techniques aimed at bypassing userland syscall-based EDR visibility. CloudSEK’s earlier analysis showed BLISTER using code-signed components, `rundll32.exe`, process hollowing, and Startup-folder persistence to deliver payloads including **Raccoon Stealer**, **Cobalt Strike Beacon**, and **BitRAT**, while Elastic linked more recent activity to deployment of the **MYTHIC** implant and to an updated **SocGholish** infection chain. Red Canary reported that **SocGholish** also changed delivery patterns, using ZIP-delivered JavaScript with filename obfuscation and **UTF-8 Cyrillic homoglyphs** to evade string-based detections, while selectively delivering second-stage malware in a subset of infections. Observed follow-on activity included host reconnaissance, Python-based persistence, browser credential theft, NTLM hash harvesting through forced authentication, and in some cases reported progression to **RansomHub** ransomware. Separate incident reporting from ReliaQuest showed how another JavaScript-based loader, **Gootloader**, enabled a long-dwell intrusion that escalated from SEO-poisoning and ZIP-delivered script execution to **SystemBC** access, LDAP discovery, Kerberoasting, RDP lateral movement, credential dumping, and exfiltration, underscoring how modern loaders are being refined as stealthy entry points for credential theft, post-exploitation, and ransomware operations.
Aug 15, 2026