Loading story…
AZORult, a long-running credential-stealing malware family tied to the Genesis Store cybercrime marketplace, has continued to appear in new delivery campaigns despite earlier reports that browser security changes had crippled its core theft capabilities. Earlier research linked more than 300,000 infections sold through Genesis to AZORult or its suppliers, showing how the malware fit into a broader malware-as-a-service and stolen-access supply chain. Although a Google Chrome update was reported to have disrupted older AZORult builds and pushed some criminal operators toward other stealers, subsequent activity indicates the malware remained in circulation through updated or repackaged campaigns.
Recent and historical reporting shows AZORult being distributed through spam emails, ZIP or ISO archives, malicious LNK and HTA files, and heavily obfuscated script chains using PowerShell, batch files, JavaScript, and scheduled tasks. The malware has been used against targets including Korean users and German automotive businesses, where it stole browser credentials, cookies, autofill data, email and messaging app data, cryptocurrency wallet files, screenshots, and system information, while also supporting follow-on payload delivery. Newer campaigns emphasized in-memory execution, anti-analysis checks, and minimal disk artifacts to evade detection, underscoring AZORult's persistence as a commodity infostealer within a more outsourced and opportunistic cybercrime ecosystem.
Pull IOCs and campaign context straight into your stack.
15 events from the most recent confirmed update back to the earliest known activity.
Kaspersky reported that Babuk ransomware source code was released in September 2021. The release was cited as part of a broader trend of leaked offensive tooling lowering barriers for cybercriminals.
A phishing and malware campaign targeting German automotive organizations was active by the end of July 2021. The operation used German-language phishing emails, ISO attachments, and HTA-based infection chains to deliver commodity stealers including AZORult.
A March 2021 analysis detailed a multistage AZORult infection chain starting from a malicious Excel workbook and using VBA, JavaScript, VBScript, PowerShell, .NET components, and LOLBins such as mshta, schtasks, and cmstp. The article linked the sample to Gorgon Group cluster one and documented persistence via Run keys and scheduled tasks, a CMSTP-based UAC bypass, Defender tampering, and process hollowing into svchost.exe.
A new 32 GUID class appeared on the Genesis market in late 2019. It did not replace the dominant 8-8-8-8-8 class.
AZORult's original developer stopped sales and maintenance in late 2018 after the malware's source code became widespread and spawned offshoots. Despite this, the malware remained active in later campaigns.
In late 2018, Genesis Store shifted from its earlier GUID class to the 8-8-8-8-8 GUID pattern and increased the number of infected machines it offered. Researchers later tied this dominant class to AZORult.
By 2018, Russian-speaking cybercriminals had concluded that targeting organizations was more profitable than targeting individual users or Russian banks. Kaspersky says this shift helped drive greater use of ransomware, stealers, and purchased access.
Genesis Store began operating in 2018 as a pay-per-bot cybercrime marketplace selling data from infected machines. During its first year, it initially sold infections in the {MACHINENAME}_20 GUID class.
AZORult was first identified as an information-stealing malware family in 2016. It was designed to steal browser data, credentials, and cryptocurrency-related information, and could also download additional malware.
Cyble analyzed an AZORult campaign using ZIP archives with malicious LNK files disguised as PDFs, followed by obfuscated PowerShell, JavaScript, scheduled tasks, and an in-memory loader. The final payload stole browser data, credentials, wallet files, application data, screenshots, and system information before exfiltration.
The German automotive-focused campaign sent major phishing waves at the end of October 2021, the end of November 2021, and in mid-March 2022. Researchers linked the operation to more than 30 lookalike domains and infrastructure including bornagroup[.]ir.
ASEC discovered an AZORult campaign distributed through spam email attachments, including a lure archive named "Estimate Request_Construction Floor Plan.7z," indicating Korean users were among the targets. The malware stole extensive browser, email, wallet, messaging, and system data and could also download additional payloads.
Genesis Store recently abandoned AZORult as its dominant infection type and shifted to a currently unidentified trojan. The change was presented as evidence that Genesis maintained relationships with multiple malware providers.
Since mid-February, multiple cybercrime forum discussions claimed a recent Google Chrome update broke AZORult's main browser-password theft capability by changing how saved passwords were protected. Forum participants described the malware as effectively decommissioned.
Using scraped Genesis data and official AZORult logs from a malware-as-a-service provider, researchers confirmed that Genesis Store's dominant 8-8-8-8-8 GUID class was AZORult-based. They linked more than 300,000 Genesis infections to AZORult or AZORult-derived suppliers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 130 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
threatvector.cylance.com
Open sourcecyble.com
Open sourceblog.checkpoint.com
Open sourcesecurelist.com
Open sourcemaxkersten.nl
Open sourceasec.ahnlab.com
Open sourceke-la.com
Open sourceke-la.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported the appearance of **AZORult++**, a C++ rewrite of the **AZORult** information-stealing Trojan that surfaced after sales of the original malware were reportedly halted by its main seller, **CrydBrox**, in late 2018. The new strain preserves several core elements of **AZORult 3.3**, including its command-and-control communication algorithm, command structure, harvested-data storage approach, and **XOR-based encryption**, indicating continuity with the earlier malware family despite the rewrite. Analysis found the new variant to be immature and still under development, with debugging artifacts and a coding flaw that prevents its configuration string from properly controlling behavior. Even so, researchers warned it could become more dangerous than earlier versions because it can create a hidden administrator account, enable **RDP**, open a port, and grant attackers full remote desktop access to infected systems; the report also noted that AZORult had been widely traded on Russian-language forums and that users in **Russia** and **India** were among the most targeted at the start of 2019.
Aug 15, 2026
Threat researchers reported continued growth in the **infostealer** ecosystem, with new families emphasizing theft of browser credentials, session cookies, and cryptocurrency wallet data. Zscaler ThreatLabz detailed **Marco Stealer**, first observed in June 2025, which profiles infected hosts (e.g., OS version, hardware ID, IP/geolocation) and targets browser data plus cryptocurrency wallet information from browser extensions; it also searches for sensitive files in local and **cloud-synced** locations, including folders associated with *Dropbox* and *Google Drive*, and uses anti-analysis measures such as runtime string decryption. Separately, Cyfirma described **LTX Stealer**, a Windows-focused infostealer built around a bundled **Node.js runtime** and delivered via an Inno Setup installer (`Negro.exe`) that drops an unusually large (~271 MB) payload—reportedly to evade scanning heuristics. LTX Stealer targets Chromium-based browsers by extracting keys from `Local State` to decrypt saved passwords and cookies, collects screenshots, and stages data for exfiltration while using services such as *Supabase* (authentication) and *Cloudflare* (infrastructure masking). Flare’s research contextualized these developments as part of an “infostealer arms race,” observing multiple variants being marketed/updated across dark web forums and highlighting the downstream impact: analysis of **18.7M** infostealer logs (2025) found enterprise SSO/IdP credentials in more than 10% of infections, and Verizon DBIR data cited by Flare linked infostealer credential exposure to a significant share of ransomware victimization; Flare also noted stealer developers rapidly adapting to Chrome’s evolving credential protections (e.g., post-`v127` application-bound encryption and newer Chrome releases).
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026