Loading story…
Researchers detailed KPOT v2.0, a commercially sold information-stealing malware strain designed to harvest credentials and sensitive data from browsers, messaging applications, email clients, VPN and RDP software, FTP clients, gaming platforms, and cryptocurrency wallets including Jaxx. The malware was marketed on underground forums at a low price point, making it accessible to a broad range of threat actors, and its targeting of wallet users highlighted the growing overlap between credential theft and cryptocurrency-focused crime.
Observed delivery methods included email campaigns and exploit kits, including an RTF lure exploiting CVE-2017-11882 to launch a PowerShell-based loader that retrieved the final payload. Once executed, KPOT used encrypted strings, runtime API resolution, and an encrypted HTTP command-and-control configuration to receive tasks, exfiltrate system and credential data, and steal files matching attacker-defined rules. The analyzed variant notably used in-memory execution and no persistence, terminating after completing assigned tasks, and also checked for victims in CIS countries before exiting without infecting them.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
A reverse-engineering analysis of KPOT v2.0 documented its XOR-based string decryption, Murmur3-based API hashing, dynamic API resolution via PEB parsing, and memory-dumped API reconstruction. The analysis also detailed theft capabilities spanning browsers, messengers, email clients, VPNs, RDP, FTP clients, cryptocurrency wallets, and gaming platforms.
A SANS ISC diary analyzed a KPOT infection chain in which a PowerShell downloader fetched an obfuscated AutoIt script, a legitimate AutoIt interpreter, and an encrypted payload from show1[.]website. The analysis showed KPOT using process hollowing into dllhost.exe and extracted a decrypted sample with SHA-256 3fd4aa339bdfee23684ff495d884aa842165e61af85fd09411abfd64b9780146.
Flashpoint Intel observed KPOT Stealer targeting users of the Jaxx cryptocurrency wallet in September 2018. This showed the malware being used against cryptocurrency-related targets.
Proofpoint researchers observed KPOT Stealer being distributed through email campaigns and exploit kits beginning in August 2018. The malware was used to steal credentials and other data from infected systems.
A newer version of the malware, KPOT v2.0, was marketed on Russian-language underground hacking forums for about $100. The version analyzed by Proofpoint included in-memory execution and no persistence mechanism.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceisc.sans.edu
Open sourceproofpoint.com
Open sourceflashpoint-intel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **KBOT** is an active Windows file-infector that spreads by injecting polymorphic malicious code into `EXE` and `DLL` files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels. The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining **file infection, financial theft, stealthy persistence, and attacker-controlled administration** in a single threat.
Aug 14, 2026
Threat researchers documented multiple malware delivery chains using PowerShell-based loaders to fetch and execute credential theft and remote access payloads. In one campaign tied to **NullMixer**, a 32-bit loader masquerading as `sqlcmd.exe` pulled a script from a compromised WordPress site, decrypted an embedded .NET assembly, and launched the **Koi** stealer. Koi targeted credentials and data from browsers, **FileZilla**, **Discord**, **Telegram**, VPN clients, cryptocurrency wallets, and **Twilio Authy**, while also checking for **Trezor** hardware wallets; it used anti-analysis, anti-reinfection, and geofencing logic to avoid systems configured for several CIS countries. A separate PowerShell dropper hosted on `fancysunshine[.]top` was used to deploy **SectopRAT** and **HiJack Loader** while attempting to weaken defenses and erase evidence. The script added Windows Defender exclusions for the `C:` drive and selected processes, downloaded `NC.zip` and `RD.zip`, unpacked them into fake Chrome cache directories under `%TEMP%`, and executed `S-D.exe` from both locations. It also gathered the victim's external IP address and username, checked for a scheduled task named `MSSecurity`, exfiltrated results to `upload.php` over HTTP POST, and then deleted the archives, extracted files, output data, and the dropper itself to reduce forensic visibility.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026