RedLine Stealer spreads through phishing, fake software, and malware loaders
Malware Intelligence · 13 sources · Updated 2mo ago · First seen Apr 17, 2023
Researchers reported continued RedLine Stealer activity across multiple delivery chains, including phishing sites, fake cryptocurrency tools, trojanized installers, malicious Office documents, and botnet-driven payload drops. Recent analysis showed a sample disguised as a fake Netflix checker decrypting an embedded payload, writing %AppData%\winlogon.exe, and contacting siyatermi.duckdns[.]org:17044 over SOAP/HTTP via Windows Communication Foundation. Separate investigations tied RedLine delivery to AutoIt-based wrappers used on phishing pages impersonating a cryptocurrency exchange, YouTube lures for a fake Binance autobuy bot hosted on GitHub, and Excel exploit chains abusing CVE-2017-11882 to fetch and inject the stealer.
