Loading story…
Researchers detailed Bandit Stealer, a Go-based information stealer for Windows that collects browser credentials, cookies, history, credit card data, cryptocurrency wallet contents, Telegram sessions, FTP and email client logins, keystrokes, clipboard data, and host profiling information. The malware attempts privilege escalation with runas.exe, establishes persistence through the Windows Run registry key, and stores stolen data in %appdata%\local subfolders named with the victim’s country code and IP address before archiving and exfiltrating the loot through the Telegram Bot API.
Bandit Stealer also uses extensive anti-analysis and sandbox-evasion checks to avoid detection, inspecting virtualization and security processes, debugger presence, blacklisted IP addresses, MAC addresses, hardware IDs, usernames, and computer names, and terminating when it detects likely research environments. Researchers said the malware has been delivered through self-extracting archive droppers disguised as benign documents or installers, including decoy Word, OpenVPN-related, and fake Heartsender files, while embedded Linux paths and commands suggest the codebase may still be evolving or could expand beyond Windows.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabz published a technical analysis of Bandit Stealer detailing its anti-VM, anti-sandbox, anti-debugging, and blacklist-based evasion logic. The analysis also described theft of browser data, cryptocurrency wallets, keystrokes, clipboard contents, FTP credentials, and email client logins, along with storage of stolen data under %appdata%\local.
OALABS published research on Bandit Stealer's progression from early unobfuscated builds to later versions using the Garble Go obfuscator. The analysis also described reverse-engineering techniques using GoReSym and Unicorn to recover obfuscated methods and strings, and noted CloudSEK-reported flaws in the stealer's panel that exposed some data without authentication.
CloudSEK published research on Bandit Stealer's malware infrastructure, including weaknesses in the operator panel that exposed data without authentication. This added a new infrastructure-focused development to public reporting on the stealer.
Trend Micro reported Bandit Stealer as a newly emerged Go-based information stealer targeting Windows systems. The report described its delivery via self-extracting archive droppers, persistence through the Windows Run key, anti-analysis blacklist checks, and exfiltration through the Telegram Bot API.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourceresearch.openanalysis.net
Open sourcecloudsek.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Vanta Stealer**, a Python-based information-stealing malware for Windows that rapidly collects a wide range of data from infected systems. The malware is packaged with **PyInstaller** and obscured with multiple **PyArmor** layers, then uses a modular design that can download a dedicated browser extractor during execution. Reported targets include Chromium-based browsers, stored credentials, cookies, payment data, Discord tokens, Steam, Roblox, Riot Games, Valorant, Minecraft, Telegram Desktop, Mullvad VPN, cryptocurrency wallet files and recovery material, private documents, screenshots, and webcam images. After harvesting data, Vanta Stealer logs the results in `Summary.txt`, compresses the stolen files into a ZIP archive, and sends the archive with victim metadata to a predefined command-and-control endpoint over HTTP POST. Reporting on the malware said likely delivery methods include phishing attachments, fake installers, cheats, bogus software updates, tampered code repositories, and malicious search ads, and noted that defenders should watch for unusual archive uploads and restrict unapproved software while affected users reset passwords, revoke sessions, and review wallet exposure from a clean device.
Aug 6, 2026
The source code for **Titan Stealer**, a Windows information-stealing malware family sold through a Russian-language Telegram channel, was publicly exposed on GitHub, where a repository advertised the **full server, client, and admin panel**. The leaked project was described as written in **C#/.NET** with a **PHP** administration panel and promoted capabilities to harvest data from more than **70 browsers** and **70 cryptocurrency wallets**, alongside file-grabber functions and server-side decryption. Security research shows Titan Stealer uses a **32-bit GCC-compiled loader** to decrypt an embedded **Golang** payload and inject it into `AppLaunch.exe` via process hollowing. Once active, it steals browser credentials, cryptocurrency wallet data, **Telegram Desktop** artifacts, FTP client details, screenshots, system information, and selected files, then exfiltrates the data to command-and-control infrastructure as a **base64-encoded archive**. Researchers said the operators actively maintained the malware, marketed updates and bug fixes, and used a dedicated panel to review victim logins and stolen data.
Aug 15, 2026
Proofpoint and Splunk report renewed activity tied to **Phantom Stealer**, a Windows infostealer linked to the broader **Stealerium** malware family, as threat actors expand phishing and malicious-download campaigns aimed at harvesting identities and credentials. Proofpoint observed campaigns attributed to **TA2715** and **TA2536** using lures themed around payments, court summons, donations, travel, hospitality, and adult content, delivered through compressed executables, JavaScript, VBScript, ISO/IMG, and ACE attachments. The malware family, derived from an open-source .NET codebase, has proliferated into overlapping variants including Phantom and Warp Stealer. Once executed, Phantom Stealer collects browser credentials, cookies, autofill data, session tokens, FTP and SSH client secrets, email client data, VPN configurations, cryptocurrency wallet information, and other files from compromised Windows systems. Reported behaviors include application enumeration, access to browser SQLite stores such as `Login Data`, `Cookies`, and `Web Data`, unauthorized reads of WinSCP configuration folders, registry run key or scheduled-task persistence, Wi-Fi reconnaissance, PowerShell-based Windows Defender exclusions, and in some variants abuse of Chrome remote debugging to bypass browser protections and steal active sessions. Stolen data has been archived and exfiltrated through encrypted channels and services including SMTP, Discord webhooks, Telegram, and GoFile, increasing the risk of account takeover, fraud, and follow-on enterprise compromise.
Jul 13, 2026