Loading story…
Researchers detailed ongoing Snake Keylogger activity in which attackers deliver the .NET-based infostealer through phishing emails carrying archive files, malicious executables, exploit-laden RTF documents abusing CVE-2017-11882, and Excel attachments with password-protected VBA macros. In one analyzed chain, a lure such as SeptemberOrderlist.pdf.exe decrypted intermediate .NET assemblies before launching the final payload, while another used base64-encoded PowerShell to download a Snake downloader, retrieve an RC4-encrypted DLL, and deploy the malware through process hollowing.
Snake is designed to steal credentials and other sensitive data from more than 50 applications, including browsers, email and FTP clients, communication tools, wireless profiles, and Windows product information, while also capturing keystrokes, screenshots, clipboard contents, host details, geolocation, and time data. The malware can persist through scheduled tasks or Startup-folder registry changes, evade defenses by killing security tools, adding Windows Defender exclusions, and deleting itself, and exfiltrate stolen data over SMTP, FTP, or Telegram via HTTPS. Multiple researchers said Snake shares strong code and loader similarities with commodity stealers such as FormBook, Agent Tesla, Matiex, 404, Cheetah, and Phoenix, pointing to code reuse or shared tooling in the cybercrime ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Cybereason reported a spike in Snake infections in late August 2021. The company said it did not observe a clear industry or geographic targeting preference among victims during that period.
HP Wolf Security noted that Snake samples reported to MalwareBazaar in March 2021 used several obfuscators, including ConfuserEx, Beds Protector, DeepSea 4.1, Babel .NET, and NET Obfuscar. This documented active circulation and variation in the malware’s protection methods.
HP Wolf Security and Cybereason both state that Snake, a modular .NET infostealer/keylogger, was first seen in late November 2020. The malware was distributed through spam and phishing campaigns and supported credential theft, keylogging, screenshots, and multiple exfiltration methods.
Cybereason reported that a Snake sample named SeptemberOrderlist.pdf.exe used a multi-stage loader chain with .NET assemblies named representative and CF_Secretaria. The company found this staging mechanism was nearly identical to ones used by FormBook and Agent Tesla, suggesting shared tooling or code reuse.
Fortinet published analysis in November 2021 detailing a fresh Snake Keylogger variant’s infection chain, persistence through Startup-folder registry changes, credential theft, keylogging, screenshot capture, and exfiltration via SMTP, FTP, and Telegram. The report also shared malicious URLs and file hashes as indicators of compromise.
Fortinet said FortiGuard Labs captured a malicious Excel attachment in the wild that delivered a fresh Snake Keylogger variant. The lure used password-protected VBA macros and PowerShell to download a Snake downloader, retrieve an RC4-encrypted DLL, and deploy the payload via process hollowing.
HP Wolf Security published research on Snake in June 2021, describing its delivery via malicious spam, layered unpacking, persistence, process hollowing, and links to other commodity .NET keyloggers such as Matiex, 404, Cheetah, and Phoenix. The report also documented Snake’s use of CVE-2017-11882 in some campaigns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybereason.com
Open sourcefortinet.com
Open sourcethreatresearch.ext.hp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **Snake Keylogger**—also tracked as **404 Keylogger**—continues to spread through multi-stage infection chains that begin with phishing documents or other loaders and end in credential theft, surveillance, and data exfiltration. One analyzed campaign used a malicious Microsoft Word file with VBA macros that dropped an `.inf` file into `%TEMP%` and abused `LaunchINFSectionW` from `Advpack.dll` to execute the next stage through legitimate Windows components. That chain then used built-in tools to reconstruct and launch a disguised DLL downloader, which attempted to fetch an additional payload from a remote command-and-control endpoint. Separate technical analyses describe Snake as a long-running **malware-as-a-service** operation with modular .NET payloads, in-memory decryption, steganographic extraction of components, and execution techniques including process injection and process hollowing. The malware is designed to steal browser, email, FTP, Discord, and Wi-Fi credentials; log keystrokes; capture screenshots and clipboard data; profile infected hosts; and evade analysis through anti-debugging checks and termination of security tools. Researchers also reported persistence through registry keys, startup items, or scheduled tasks, and exfiltration over channels including **Telegram**, **SMTP**, and **FTP**, while linking the family to variants such as **Matiex**, **Cheetah**, and **Nova**.
Jul 13, 2026
Multiple phishing campaigns delivered **SnakeKeylogger**, **VIPKeylogger**, and **Agent Tesla** through layered infection chains that used obfuscated VBScript or PowerShell droppers, steganographic payload staging on Cloudinary, Internet Archive abuse, reflective in-memory .NET loading, and process hollowing into legitimate Windows binaries such as `Caspol.exe`, `Aspnet_compiler.exe`, and `RegAsm.exe`. One DHL-themed operation used a VIPKeylogger variant identified as a SnakeKeylogger rebrand, while a separate GuLoader campaign targeted Italian businesses with NSIS-wrapped stealers and business email compromise-style lures. Across the campaigns, the malware stole browser passwords, email and FTP credentials, Outlook and WinSCP secrets, Discord tokens, Wi-Fi passwords, screenshots, clipboard data, and keystrokes, then exfiltrated data over **SMTP**, **Telegram**, and **FTP**. Investigators found repeated operator OPSEC failures that exposed active criminal infrastructure and victim data. A VIPKeylogger/SnakeKeylogger operator left a stock **XAMPP** dashboard and internet-accessible **WinRM** open on `144.172.105.88`, while sandboxing captured plaintext SMTP credentials tied to `result@miniorangeman.com` on `185.196.9.150`; although that C2 was taken offline shortly after detection, the Cloudinary-hosted payload and SMTP infrastructure reportedly remained live. In a separate GuLoader operation, an open FTP directory on `holzbrenzii[.]com` exposed **52 credential dumps from 27 victim machines** in real time. Another SnakeKeylogger v4.4 campaign linked distinct droppers to the same backend through shared C2 strings, DDNS infrastructure, and staging artifacts, showing that technically capable malware operators repeatedly undermined their own campaigns by exposing panels, credentials, and stolen data.
Jun 29, 2026
Security researchers reported a phishing campaign using a PDF attachment named **"REMMITANCE INVOICE.pdf"** to deliver **Snake Keylogger** through a multi-stage infection chain. The PDF carried an embedded Word document that appeared trustworthy, and the document then retrieved a remote template or RTF file from attacker-controlled infrastructure. That RTF contained malformed OLE content exploiting the Microsoft Equation Editor flaw **`CVE-2017-11882`**, allowing shellcode to run and download the final Windows payload, identified in reporting as **`vbc.exe`** or **`fresh.exe`** and linked to Snake Keylogger. Analysts said the campaign relied on layered evasion, including hiding a malicious DOCX inside a PDF, hosting the exploit remotely, and decrypting shellcode in memory before execution. The final malware was described as a modular information stealer capable of credential theft, persistence, defense evasion, data collection, and exfiltration over **SMTP**. Researchers highlighted that the attack demonstrates the continued effectiveness of the long-patched **`CVE-2017-11882`** vulnerability and advised defenders to analyze suspicious files with dedicated tooling rather than opening them in PDF or Office applications.
Aug 15, 2026