Loading story…
Researchers reported that BloodyStealer, a low-cost information-stealing malware sold on a Russian-speaking underground forum, was being used to harvest browser data, system details, and active sessions from gaming and messaging platforms. The malware specifically targeted services including Steam, Origin, Epic Games, GOG, Bethesda, Telegram, and VimeWorld, and used anti-analysis features, victim fingerprinting, command-and-control communications, and ZIP-based data exfiltration to steal data from infected systems.
The stolen data fed a broader criminal marketplace where gaming logs, compromised accounts, in-game items, and phishing kits were bought and sold for profit. Researchers said the malware appeared in multistage infection chains alongside threats such as KeyBase and Agent Tesla, with detections across Europe, Latin America, and APAC, primarily affecting home users as attackers monetized virtual goods, account access, and gaming-related credentials through wholesale and retail underground sales.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A seller advertised BloodyStealer on a Russian-speaking underground forum, promoting it as a low-cost stealer for browser data, system information, screenshots, and sessions from gaming and messaging platforms. The ad also said operators could manage stolen data through Telegram channels or a web panel.
Kaspersky published an analysis of BloodyStealer, describing its anti-analysis protections, victim fingerprinting, ZIP-based exfiltration, and use in multistage infection chains with malware such as KeyBase and Agent Tesla. The report also noted detections across Europe, Latin America, and APAC, primarily affecting home users.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Vanta Stealer**, a Python-based information-stealing malware for Windows that rapidly collects a wide range of data from infected systems. The malware is packaged with **PyInstaller** and obscured with multiple **PyArmor** layers, then uses a modular design that can download a dedicated browser extractor during execution. Reported targets include Chromium-based browsers, stored credentials, cookies, payment data, Discord tokens, Steam, Roblox, Riot Games, Valorant, Minecraft, Telegram Desktop, Mullvad VPN, cryptocurrency wallet files and recovery material, private documents, screenshots, and webcam images. After harvesting data, Vanta Stealer logs the results in `Summary.txt`, compresses the stolen files into a ZIP archive, and sends the archive with victim metadata to a predefined command-and-control endpoint over HTTP POST. Reporting on the malware said likely delivery methods include phishing attachments, fake installers, cheats, bogus software updates, tampered code repositories, and malicious search ads, and noted that defenders should watch for unusual archive uploads and restrict unapproved software while affected users reset passwords, revoke sessions, and review wallet exposure from a clean device.
Aug 6, 2026
Proofpoint reported that **Nocturnal Stealer**, a low-cost information-stealing malware sold on an underground forum for **1,500 Rubles** (about **$25**), was observed being deployed in the wild by an unknown loader. The malware targets **Chromium- and Firefox-based browsers**, **cryptocurrency wallets**, and **FileZilla** FTP credentials, harvesting stored usernames, passwords, cookies, autofill data, payment card details, wallet information, and host system data. The stealer stages stolen data locally and exfiltrates it to a command-and-control server over **HTTP POST** requests using the `User-Agent` string `Nocturnal/1.0`. Proofpoint said the malware includes basic anti-analysis features, including anti-VM checks, queries `ip-api.com` to identify the victim's external IP address and country code, and deletes dropped files after sending the data. Researchers assessed the malware as relatively unsophisticated, but warned that its low price and broad credential theft capabilities make it accessible to low-skill criminals and potentially damaging at scale.
Jun 29, 2026
**Stealc**, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures. Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.
Sep 9, 2026