Loading story…
Researchers detailed a MetaStealer infection chain delivered through malicious email attachments and links, including Excel macro documents and OneNote files, that infected Windows systems and established persistence for follow-on payload delivery. In the observed campaigns, enabling macros or opening the lure file launched scripts that retrieved components from GitHub and transfer.sh, built a persistent executable on the host, and modified HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell so the malware would restart after reboot. Analysts said the infrastructure remained active near the time of publication, and network traffic to 193.106.191.162:1775 matched EmergingThreats Pro detections for Win32/MetaStealer activity.
Separate reverse engineering showed MetaStealer used XOR-based string decryption and a domain generation algorithm (DGA) to supplement or replace static command-and-control infrastructure by generating multiple .xyz domains for beaconing. Decrypted strings and observed behavior indicated capabilities beyond credential theft, including SOCKS proxying, backconnect access, firewall rule manipulation, shellcode execution, and tasking endpoints, underscoring that MetaStealer functioned as a flexible post-compromise stealer and access tool rather than a simple infostealer.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
On May 11, 2023, OpenAnalysis published analysis of a MetaStealer sample, including YARA rules, XOR-decoded strings, and evidence of browser-data theft, tasking paths such as /api/client/new and /tasks/collect, and probable C2 port 1775. The analysis also documented a PowerShell command to add a Microsoft Defender exclusion for .exe files, indicating defense-evasion behavior.
EmergingThreats Pro signatures 2851362 and 2851363 for Win32/MetaStealer Related Activity were released on April 1, 2022. These signatures detected the malware's GET and POST traffic to its command-and-control infrastructure.
At least 16 samples of a malicious Excel attachment tied to a MetaStealer campaign had been submitted to VirusTotal starting on March 30, 2022. The files were distributed as email attachments and required victims to enable macros.
Proofpoint reported that RedLine Stealer was under active development and that new features such as cold cryptocurrency wallet theft were added in March 2020. This marked an expansion of the malware's theft capabilities.
In March 2020, Proofpoint researchers discovered a phishing campaign distributing RedLine Stealer, primarily targeting U.S. healthcare and manufacturing organizations. The emails used COVID-19 and Folding@home-themed lures and directed victims to a BitBucket-hosted payload.
Advertisements for RedLine Stealer appeared on criminal forums as early as February 20, 2020, offering the malware for sale in multiple pricing tiers. Some ads also offered cracked versions.
At the time of writing, Walmart reported that the generated domain wgcuwcgociewewoo.xyz resolved and that another hostname, mmswgeewswyyywqk.xyz, had previously been active. Both domains were in the DGA-derived list for seed 0x1234.
Walmart researchers analyzed a MetaStealer sample and documented its XOR-based string decryption and domain generation algorithm. They found the malware generated multiple .xyz domains and appeared to use DGA-derived infrastructure as a primary C2 method.
KELA had previously observed the threat actor '_META_' marketing a new stealer described as having the same functionality and panel as RedLine Stealer. This linked MetaStealer's ecosystem to RedLine-like capabilities.
Before the Walmart analysis, Unit 42 had tweeted about a campaign in which a malicious email link downloaded a OneNote file that dropped and executed MetaStealer. This documented a separate delivery method for the malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 34 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
research.nccgroup.com
Open sourceisc.sans.edu
Open sourceisc.sans.edu
Open sourceresearch.openanalysis.net
Open sourcemedium.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers Jason Reaves and Joshua Platt reported new infrastructure and malware activity tied to **MetaStealer**, identifying a new wordlist-based domain generation algorithm while confirming the malware’s older DGA is still active. Their analysis found MetaStealer gate servers are largely domain-agnostic and depend more on IP address, port, URI, and HTTP headers to relay traffic, indicating operators can shift domains without significantly changing backend behavior. The investigation also uncovered a related Windows payload called **RuntimeSync**, described internally as a “tracker” and still appearing to be under development. The malware includes backdoor and RAT functions such as keylogging, screenshot and desktop video capture, file upload, self-updating, and remote command execution, and it uses its own DGA for communications. Researchers said the analyzed routine used a hardcoded seed, generated 1,000 domains from a 101-word list with width three, and used the hardcoded TLD `com`; they also published network and endpoint indicators for both MetaStealer and RuntimeSync.
Jun 29, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026