Loading story…
Researchers exposed KeyBase, a low-cost commercial keylogger sold for about $50 and used in widespread phishing campaigns against organizations worldwide, with notable targeting in the high tech, higher education, and retail sectors. Over a four-month period, analysts tracked 295 unique samples across roughly 1,500 sessions and linked the activity to about 50 command-and-control servers. Written in C# on the .NET Framework, the malware supports keylogging, screenshot capture, clipboard theft, download-and-execute, persistence, and a kill timer.
The malware’s command-and-control traffic used unencrypted HTTP with predictable requests and hardcoded paths, making network detection comparatively straightforward. Researchers also found major weaknesses in the operators’ own infrastructure, including unauthenticated access to stolen screenshots and an arbitrary file upload flaw in the web panel that could expose attacker credentials and allow unauthorized access to the management interface.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A user named Support™ announced KeyBase on hackforums.net and advertised features such as advanced keylogging, a web panel, Unicode support, and password recovery.
The domain keybase[.]in, used to market the KeyBase malware family, was created. The malware was later sold directly by its author through this domain.
KeyBase was first observed active in the wild in February 2015. It was primarily distributed through phishing emails with executable or screen-saver attachments and used in campaigns targeting organizations worldwide.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **KeyBase** credential-stealing trojan continued to spread widely even after its public takedown, with attackers distributing it through phishing emails and Office exploit kits. The malware steals browser and email passwords, logs keystrokes and clipboard data, captures screenshots, and uploads stolen information to a web management panel known as **Keypanel**. Analysis of exposed infrastructure found **82 active panels across 64 websites**, **933 infected Windows systems**, and **125,083 screenshots**, showing that operators were still actively collecting data from victims. The exposed screenshots and panel data revealed heavy targeting in **India, China, South Korea, the United Arab Emirates, Indonesia, Bangladesh, and Djibouti**, with manufacturing, transportation, hospitality, education, and business operations among the affected sectors. Researchers linked campaigns to phishing lures such as purchase orders and aviation-themed messages, and found evidence that attackers used embedded Nirsoft tools including `MailPassView` and `WebBrowserPassView`, stored in AES-encrypted form and unpacked at runtime, alongside obfuscated strings and compromised email accounts. The stolen material included banking activity, cargo and purchase-order details, hotel guest information, educational records, and other data consistent with credential theft, invoice fraud, and supply-chain compromise.
Aug 15, 2026
Researchers detailed how **Snake Keylogger**—also tracked as **404 Keylogger**—continues to spread through multi-stage infection chains that begin with phishing documents or other loaders and end in credential theft, surveillance, and data exfiltration. One analyzed campaign used a malicious Microsoft Word file with VBA macros that dropped an `.inf` file into `%TEMP%` and abused `LaunchINFSectionW` from `Advpack.dll` to execute the next stage through legitimate Windows components. That chain then used built-in tools to reconstruct and launch a disguised DLL downloader, which attempted to fetch an additional payload from a remote command-and-control endpoint. Separate technical analyses describe Snake as a long-running **malware-as-a-service** operation with modular .NET payloads, in-memory decryption, steganographic extraction of components, and execution techniques including process injection and process hollowing. The malware is designed to steal browser, email, FTP, Discord, and Wi-Fi credentials; log keystrokes; capture screenshots and clipboard data; profile infected hosts; and evade analysis through anti-debugging checks and termination of security tools. Researchers also reported persistence through registry keys, startup items, or scheduled tasks, and exfiltration over channels including **Telegram**, **SMTP**, and **FTP**, while linking the family to variants such as **Matiex**, **Cheetah**, and **Nova**.
Jul 13, 2026
Researchers reported active phishing operations using business-document lures and fake "secure mail" messages to infect Windows users with **VIP Keylogger** and related infostealers. Splunk said attackers sent payment notices, procurement orders, and logistics updates carrying heavily obfuscated `.vbs`, `.js`, or `.bat` loaders that launched PowerShell stagers, hid data in environment variables, and used steganography in PNG files to rebuild the final payload. K7 Labs also tracked a malware-as-a-service **VIP_Keylogger** campaign, while Splunk said the malware injects into `aspnet_compiler.exe` and steals keystrokes, screenshots, browser and Outlook credentials, clipboard contents, and cryptocurrency wallet addresses before exfiltrating data to attacker infrastructure, including Telegram. AhnLab separately detailed a South Korea-focused campaign impersonating a major credit card company with malicious LNK files that executed PowerShell and `mshta`, fetched an HTA with obfuscated VBScript, and displayed decoy documents to reduce suspicion. The malware changed behavior depending on whether Windows Defender was enabled: one path delivered AES-encrypted archives with backdoor, keylogging, clipboard theft, and information-stealing components, while the other used `rundll32` to load a downloader that avoided VBox and VMware and then pulled additional payloads from Google Drive to steal browser, email, cookie, clipboard, and cryptocurrency wallet data. Defenders were urged to scrutinize email attachments and file types, monitor suspicious registry and PowerShell activity, and watch for script-launched processes and Telegram-related DNS traffic.
Jun 29, 2026