Loading story…
ESET disclosed a previously undocumented malware family, IIStealer (Win64/BadIIS), that compromises Microsoft IIS web servers and steals payment-card and other checkout data from e-commerce sites. The malware is implemented as a malicious native IIS module, allowing it to load inside the IIS worker process, intercept inbound HTTP POST requests sent to hardcoded checkout paths, and capture request bodies containing customer payment information and other transaction details.
Because IIStealer runs on the server after HTTPS traffic has already been decrypted, it can bypass the protection shoppers expect from SSL/TLS and harvest data directly during transaction processing. ESET observed the threat on a small number of U.S.-based IIS servers between September 2020 and January 2021, with the malware storing stolen data locally and later exfiltrating it through specially crafted HTTP requests to the compromised server; in some cases it masqueraded as a legitimate IIS component under the filename dir.dll, highlighting how native IIS extensibility can be abused for persistent, hard-to-detect server-side skimming.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
ESET disclosed and analyzed a previously undocumented IIS malware family named IIStealer, detected as Win64/BadIIS. The publication included technical details, indicators of compromise, YARA rules, and a white paper/GitHub resources.
ESET telemetry indicated the IIStealer malware targeted a small number of IIS servers in the United States and stole checkout data from compromised e-commerce websites. The observed activity occurred between September 2020 and January 2021.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcei.blackhat.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET disclosed **IISpy**, a previously undocumented server-side backdoor built as a malicious native module for **Microsoft Internet Information Services (IIS)**, enabling long-term espionage on compromised web servers. The implant has reportedly been active since at least July 2020 and likely reaches victims through exploitation of a server-side vulnerability, with operators also observed using **Juicy Potato** to gain the administrative privileges required to install the module. Telemetry identified affected IIS servers in **Canada, the United States, and the Netherlands**, although researchers said the true scope is likely larger because many servers do not run security software. Once installed, IISpy passively inspects inbound HTTP requests and waits for specially crafted attacker traffic, then executes encrypted commands and hides encrypted responses inside fake **PNG** images returned by the server. By abusing IIS native-module functionality documented in Microsoft's native-code API, the malware integrates directly into web-server processing while using anti-forensic features to rewrite or strip request data before it is logged. That behavior causes malicious activity to appear in IIS logs as benign `GET` requests to the root path, complicating detection and incident response.
Aug 14, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026
Cisco Talos reported that a **BadIIS** malware variant identified by embedded `demo.pdb` strings is being used as a commodity **malware-as-a-service** offering by multiple Chinese-speaking cybercrime groups. The IIS malware supports traffic redirection, reverse proxying, content hijacking, and backlink injection, enabling operators to monetize compromised web servers through **SEO fraud** and other web traffic abuse. Talos said the tooling has been under active development from at least September 2021 through January 2026, with customer-specific builds and feature changes that included antivirus evasion such as Norton bypass functionality. Researchers also recovered a builder and related installer, dropper, and persistence components tied to the string `lwxat`, which Talos assesses is likely the developer alias behind the ecosystem. The tooling can deploy both 32-bit and 64-bit BadIIS modules, register them within IIS, and restore hidden backup copies after server restarts to maintain persistence. Activity was observed mainly across the Asia-Pacific region, with additional victims in South Africa, Europe, and North America, while Talos said the shared tooling strongly links the campaigns to the same developer even though attribution to a single threat actor remains difficult.
Jun 29, 2026