Loading story…
Check Point Research reported a new Azorult 3.3 information-stealing malware variant being distributed in the wild through the RIG exploit kit and other delivery channels. The updated build appears to follow earlier leaks of Azorult 3.1 and 3.2 source code and builders, and introduces multiple changes aimed at improving resilience and theft capability, including a new embedded command-and-control (C2) domain encryption method, a modified C2 connection routine, and a repaired loader component.
The malware also expands cryptocurrency targeting by adding wallet applications including BitcoinGold, ElectrumG, Electrum-btcp, BitCore, BitcoinABC, and Exodus Eden. Researchers said Azorult 3.3 now creates its temporary working directory from a victim-specific hash instead of a static version-based name, complicating straightforward tracking of infections, and published associated malware hashes, C2 URLs, and a detection signature for defenders.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
An advertisement for Azorult version 3.3 was posted on the exploit.in underground forum by the user CrydBrox. The ad promoted updates including improved cryptocurrency wallet theft, a fixed loader component, lower antivirus detection rates, and better installation success.
Check Point Research reported a newly observed Azorult 3.3 information stealer active in the wild and being delivered through the RIG exploit kit and other sources. The report also documented technical changes in the malware and published hashes, C2 URLs, and a detection signature for the new variant.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported the appearance of **AZORult++**, a C++ rewrite of the **AZORult** information-stealing Trojan that surfaced after sales of the original malware were reportedly halted by its main seller, **CrydBrox**, in late 2018. The new strain preserves several core elements of **AZORult 3.3**, including its command-and-control communication algorithm, command structure, harvested-data storage approach, and **XOR-based encryption**, indicating continuity with the earlier malware family despite the rewrite. Analysis found the new variant to be immature and still under development, with debugging artifacts and a coding flaw that prevents its configuration string from properly controlling behavior. Even so, researchers warned it could become more dangerous than earlier versions because it can create a hidden administrator account, enable **RDP**, open a port, and grant attackers full remote desktop access to infected systems; the report also noted that AZORult had been widely traded on Russian-language forums and that users in **Russia** and **India** were among the most targeted at the start of 2019.
Aug 15, 2026
AZORult, a long-running credential-stealing malware family tied to the **Genesis Store** cybercrime marketplace, has continued to appear in new delivery campaigns despite earlier reports that browser security changes had crippled its core theft capabilities. Earlier research linked more than **300,000 infections** sold through Genesis to AZORult or its suppliers, showing how the malware fit into a broader malware-as-a-service and stolen-access supply chain. Although a Google Chrome update was reported to have disrupted older AZORult builds and pushed some criminal operators toward other stealers, subsequent activity indicates the malware remained in circulation through updated or repackaged campaigns. Recent and historical reporting shows AZORult being distributed through **spam emails**, **ZIP or ISO archives**, malicious **LNK** and **HTA** files, and heavily obfuscated script chains using PowerShell, batch files, JavaScript, and scheduled tasks. The malware has been used against targets including **Korean users** and **German automotive businesses**, where it stole browser credentials, cookies, autofill data, email and messaging app data, cryptocurrency wallet files, screenshots, and system information, while also supporting follow-on payload delivery. Newer campaigns emphasized **in-memory execution**, anti-analysis checks, and minimal disk artifacts to evade detection, underscoring AZORult's persistence as a commodity infostealer within a more outsourced and opportunistic cybercrime ecosystem.
Aug 15, 2026
ESET disclosed **KryptoCibule**, a previously undocumented malware family active since at least late 2018 that primarily targeted users in **Czechia and Slovakia** through malicious torrents posing as cracked software installers. The malware combined several cryptocurrency-focused functions: it mined coins on infected systems, monitored the clipboard to replace copied wallet addresses and redirect payments, searched for cryptocurrency wallets and related files for exfiltration, and also exposed **remote-access trojan (RAT)** capabilities. The campaign relied heavily on **Tor** and **BitTorrent** infrastructure and either bundled or fetched legitimate tools including **Tor**, **Transmission**, **Apache httpd**, and **Buru SFTP Server** to support command-and-control and data theft through onion services hosted on compromised machines. ESET said KryptoCibule used layered evasion and persistence measures, including obfuscation, masquerading as Adobe Reader components, scheduled tasks, Windows Defender exclusions, firewall rule changes, and checks for analysis tools and antivirus products; although only hundreds of victims were observed, the malware remained active and continued to gain new capabilities.
Aug 15, 2026