Loading story…
Researchers reported that the KeyBase credential-stealing trojan continued to spread widely even after its public takedown, with attackers distributing it through phishing emails and Office exploit kits. The malware steals browser and email passwords, logs keystrokes and clipboard data, captures screenshots, and uploads stolen information to a web management panel known as Keypanel. Analysis of exposed infrastructure found 82 active panels across 64 websites, 933 infected Windows systems, and 125,083 screenshots, showing that operators were still actively collecting data from victims.
The exposed screenshots and panel data revealed heavy targeting in India, China, South Korea, the United Arab Emirates, Indonesia, Bangladesh, and Djibouti, with manufacturing, transportation, hospitality, education, and business operations among the affected sectors. Researchers linked campaigns to phishing lures such as purchase orders and aviation-themed messages, and found evidence that attackers used embedded Nirsoft tools including MailPassView and WebBrowserPassView, stored in AES-encrypted form and unpacked at runtime, alongside obfuscated strings and compromised email accounts. The stolen material included banking activity, cargo and purchase-order details, hotel guest information, educational records, and other data consistent with credential theft, invoice fraud, and supply-chain compromise.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
By February 2016, Unit 42 had identified 64 websites hosting 82 active KeyBase web panels, tied to 933 infected Windows systems and 125,083 screenshots exposed through unauthenticated panel storage.
In June 2015, Unit 42 said it had previously reported on the KeyBase malware family after its initial emergence.
Unit 42 reported that the KeyBase malware family first appeared in February 2015, marking the beginning of observed activity for the credential-stealing trojan.
Sophos found multiple KeyBase server-side panel installations on the jobme.eu server and linked specific malware samples to panel folders including "roko" and "ocha."
Sophos documented KeyBase being widely distributed during 2015–2016 through Office exploit kits and phishing emails carrying archived Windows executables.
A healthcare company suffered repeated KeyBase infections on September 7, September 10, and September 13, with the final phishing email apparently sent from an internal company email account.
Unit 42 observed that KeyBase use grew significantly after June 2015 even though active development appeared to have stopped and the public takedown had occurred.
The original KeyBase project and website were taken down after increased criminal use, and the author reportedly claimed to stop selling the malware. Despite this, new samples and downloads remained available afterward.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 61 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
nakedsecurity.sophos.com
Open sourcevirusbulletin.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers exposed **KeyBase**, a low-cost commercial keylogger sold for about **$50** and used in widespread phishing campaigns against organizations worldwide, with notable targeting in the **high tech, higher education, and retail** sectors. Over a four-month period, analysts tracked **295 unique samples** across roughly **1,500 sessions** and linked the activity to about **50 command-and-control servers**. Written in **C#** on the **.NET Framework**, the malware supports keylogging, screenshot capture, clipboard theft, download-and-execute, persistence, and a kill timer. The malware’s command-and-control traffic used **unencrypted HTTP** with predictable requests and hardcoded paths, making network detection comparatively straightforward. Researchers also found major weaknesses in the operators’ own infrastructure, including **unauthenticated access** to stolen screenshots and an **arbitrary file upload** flaw in the web panel that could expose attacker credentials and allow unauthorized access to the management interface.
Aug 14, 2026
Researchers reported active phishing operations using business-document lures and fake "secure mail" messages to infect Windows users with **VIP Keylogger** and related infostealers. Splunk said attackers sent payment notices, procurement orders, and logistics updates carrying heavily obfuscated `.vbs`, `.js`, or `.bat` loaders that launched PowerShell stagers, hid data in environment variables, and used steganography in PNG files to rebuild the final payload. K7 Labs also tracked a malware-as-a-service **VIP_Keylogger** campaign, while Splunk said the malware injects into `aspnet_compiler.exe` and steals keystrokes, screenshots, browser and Outlook credentials, clipboard contents, and cryptocurrency wallet addresses before exfiltrating data to attacker infrastructure, including Telegram. AhnLab separately detailed a South Korea-focused campaign impersonating a major credit card company with malicious LNK files that executed PowerShell and `mshta`, fetched an HTA with obfuscated VBScript, and displayed decoy documents to reduce suspicion. The malware changed behavior depending on whether Windows Defender was enabled: one path delivered AES-encrypted archives with backdoor, keylogging, clipboard theft, and information-stealing components, while the other used `rundll32` to load a downloader that avoided VBox and VMware and then pulled additional payloads from Google Drive to steal browser, email, cookie, clipboard, and cryptocurrency wallet data. Defenders were urged to scrutinize email attachments and file types, monitor suspicious registry and PowerShell activity, and watch for script-launched processes and Telegram-related DNS traffic.
Jun 29, 2026
Multiple phishing campaigns delivered **SnakeKeylogger**, **VIPKeylogger**, and **Agent Tesla** through layered infection chains that used obfuscated VBScript or PowerShell droppers, steganographic payload staging on Cloudinary, Internet Archive abuse, reflective in-memory .NET loading, and process hollowing into legitimate Windows binaries such as `Caspol.exe`, `Aspnet_compiler.exe`, and `RegAsm.exe`. One DHL-themed operation used a VIPKeylogger variant identified as a SnakeKeylogger rebrand, while a separate GuLoader campaign targeted Italian businesses with NSIS-wrapped stealers and business email compromise-style lures. Across the campaigns, the malware stole browser passwords, email and FTP credentials, Outlook and WinSCP secrets, Discord tokens, Wi-Fi passwords, screenshots, clipboard data, and keystrokes, then exfiltrated data over **SMTP**, **Telegram**, and **FTP**. Investigators found repeated operator OPSEC failures that exposed active criminal infrastructure and victim data. A VIPKeylogger/SnakeKeylogger operator left a stock **XAMPP** dashboard and internet-accessible **WinRM** open on `144.172.105.88`, while sandboxing captured plaintext SMTP credentials tied to `result@miniorangeman.com` on `185.196.9.150`; although that C2 was taken offline shortly after detection, the Cloudinary-hosted payload and SMTP infrastructure reportedly remained live. In a separate GuLoader operation, an open FTP directory on `holzbrenzii[.]com` exposed **52 credential dumps from 27 victim machines** in real time. Another SnakeKeylogger v4.4 campaign linked distinct droppers to the same backend through shared C2 strings, DDNS infrastructure, and staging artifacts, showing that technically capable malware operators repeatedly undermined their own campaigns by exposing panels, credentials, and stolen data.
Jun 29, 2026