Loading story…
Researchers reported that a new version of Xehook Stealer is being delivered by SmokeLoader, with evidence indicating the malware is focused on cryptocurrency theft. Spamhaus said the stealer retrieves its configuration through an HTTP GET request and includes an embedded build ID, cryptostage, alongside the version string 2.0.8 Stable. The variant reportedly targets cryptocurrency-related domains and applications and shows similarities to Agniane Stealer, supporting assessments that both malware families may share the same author.
Further analysis described Xehook as a .NET-based Windows information stealer likely tied to Agniane Stealer and the earlier Cinoshi malware-as-a-service operation through shared Telegram identifiers, renamed forum accounts, similar web panels, overlapping code, and common command-and-control infrastructure. The malware is loaded through a chain in which SmokeLoader decrypts and injects Xehook into RegAsm.exe, then uses anti-analysis checks for language, processes, timing, and virtualization before stealing browser credentials, cookies, autofill data, screenshots, files, and data from wallets, 2FA extensions, Telegram, Discord, Steam, and FileZilla, with logs exfiltrated to its C2 before local artifacts are removed.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
CRIL discovered Xehook Stealer, a .NET-based Windows information stealer marketed with browser, wallet, and application theft capabilities. The malware was later assessed as likely connected to Agniane Stealer and the earlier Cinoshi project.
Agniane Stealer emerged and referenced Cinoshi in its note. Subsequent analysis linked Agniane, Cinoshi, and Xehook through shared infrastructure, code, and operator identifiers.
The Cinoshi project launched as a free Malware-as-a-Service stealer and web panel offering. Later reporting assessed Xehook as a likely successor to this earlier project.
Spamhaus researchers observed a new version of Xehook Stealer being downloaded by SmokeLoader. The sample used an HTTP GET request to retrieve configuration indicating cryptocurrency-focused targeting and contained the build ID "cryptostage" with version string "2.0.8 Stable."
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple financially motivated malware campaigns using **SmokeLoader** as a delivery mechanism for follow-on payloads including **Gozi ISFB**, **ZLoader**, **Oski**, **AveMaria**, **Cobalt Strike**, **SystemBC**, **RecordBreaker**, and the **Laplas Clipper** cryptocurrency hijacker. In one campaign set, attackers abused website contact forms and sent phishing lures posing as copyright complaints, directing victims to malicious documents hosted on legitimate services such as **Google Drive**. Talos found the initial payloads were wrapped in a shared crypter identified by the DOS-stub string **"Salfram,"** indicating a common tooling layer across otherwise varied malware deliveries. The activity relied on evasive and modular infection chains designed to complicate detection and maximize monetization. The **Salfram** crypter used obfuscation methods including fake API calls, fragmented control flow, self-modifying code, and memory allocation through `ZwAllocateVirtualMemory`, while later-stage malware added persistence and theft capabilities. Cyble said **Laplas Clipper** monitored the clipboard for cryptocurrency wallet addresses, pulled regex patterns and replacement addresses from `clipper[.]guru`, and persisted by copying itself into `%appdata%` and creating a scheduled task that ran every minute. The combined use of phishing, legitimate hosting platforms, crypter-based obfuscation, and multi-payload delivery shows an adaptable criminal ecosystem built to steal credentials, proxy access, banking data, and cryptocurrency funds.
Aug 15, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026
**SmokeLoader** has continued to evolve as an actively maintained malware loader and backdoor, with newer variants replacing older XOR-based string and command-and-control decoding with **RC4-based encryption** and more complex controller-domain decryption. Reporting indicates infected systems send host details to C2 infrastructure and receive encrypted payloads that can deliver plugins, download additional files, or manage related malware such as **Dofoil**. Researchers also observed host-derived mutex generation, a trait that can be used defensively to block some infections, alongside debug-related code that suggests ongoing development. Separate technical analysis describes SmokeLoader as a phishing-delivered malware family associated with **Smoky Spider**, using runtime API resolution, anti-debugging and anti-VM checks, **process hollowing**, and injection into `explorer.exe` to sustain command-and-control communications or deploy follow-on payloads. The malware’s role as a loader for additional malicious tools, combined with updated obfuscation and encryption routines, underscores its continued use in multi-stage intrusions and its adaptability against analysis and disruption efforts.
Aug 15, 2026