Loading story…
Researchers reported that the X-FILES/XFiles Reborn infostealer was delivered through campaigns abusing the Microsoft Follina vulnerability, adding another distribution path alongside phishing sites posing as legitimate software. The malware is a C#-based stealer that uses a downloader shellcode to retrieve and execute payloads from the same command-and-control server, with infrastructure linked to Russian-hosted phishing pages and a Russian-hosted C2 panel.
Once executed, the stealer collects a wide range of victim data, including browser credentials, financial and credit card data, cryptocurrency wallet information, FTP credentials, Telegram data, Discord tokens, Steam information, screenshots, and selected .txt and .pdf files. Newer variants were found to create working folders such as %APPDATA%, store stolen content in Grabber and Browsers directories, write host details to PCInfo.txt, dynamically pull wallet target paths from C2, crawl directories for browser theft, steal both FileZilla and WinSCP data, and exfiltrate results to command-and-control servers in JSON format with improved obfuscation over earlier versions.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
ThreatLabz discovered a revised X-FILES variant in June 2022. The newer sample expanded data theft, improved obfuscation with Base64-encoded strings, updated C2 behavior, and exfiltrated stolen data in JSON format.
A second X-FILES variant was observed in December 2021, according to Zscaler. This version added capabilities including wallet theft and FileZilla-related credential theft compared with the March 2021 sample.
Zscaler ThreatLabz reported that the earliest X-FILES infostealer variant was first observed in March 2021. This oldest C#-based variant lacked some later capabilities such as wallet and FTP theft.
Researchers observed threat actors exploiting the Follina vulnerability to deliver X-FILES/XFiles Reborn through a malicious .docx-based infection chain. Associated artifacts included LoadingUpdate.html and ChimLacUpdate.exe, with shellcode downloading the stealer payload from the same C2 server.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026