Loading story…
Kaspersky detailed an intrusion involving Predator the Thief after a client received an anonymous screenshot that had allegedly been exfiltrated from an internal system to the malware’s command-and-control server. The investigation identified Predator as a low-cost information stealer developed by Russian-speaking operators and marketed on Russian-language cybercrime forums, where it was promoted as a commodity tool for credential and data theft.
Technical analysis from Kaspersky and independent researcher Fumik0 showed the malware evolving from v2 to v3 with stronger obfuscation, anti-debugging and sandbox-evasion checks, broader browser theft support including Microsoft Edge and Internet Explorer, and a clipboard-stealing function inaccurately advertised by its operators as a keylogger. The reporting also described Predator’s commercial ecosystem, including sales on the VLMI forum, customer update channels on Telegram, frequent fully undetectable build refreshes, versioned samples from 3.0.3 through 3.0.7, and published detection material such as hashes and a YARA rule.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs discovered a phishing campaign in March 2019 targeting Russian speakers and delivering Predator the Thief, primarily version 3.0.8, via fake documents, ZIP archives, fake PDFs, and exploitation of the WinRAR ACE flaw CVE-2018-20250. The report linked the activity to a Russian-speaking actor associated with the username "nrjat" and documented the campaign's C2 infrastructure and malware delivery chain.
A screenshot allegedly exfiltrated by Predator was reportedly taken from an infected internal computer while an employee was browsing emails. The anonymous source said the image had been transferred to a Predator command-and-control server.
In mid-February, Kaspersky received an incident response request from a client after an anonymous source shared the screenshot from one of the client's internal computers. Kaspersky then conducted a full investigation of the infected machine, including memory dumps, event logs, and network indicators.
French malware researcher Fumik0_ analyzed Predator the Thief version 2.3.5. Kaspersky later cited this October 2018 work as part of Predator's documented evolution from v2 to v3.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourcesecurelist.com
Open sourcefumik0.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple credential-theft threats targeting browsers, wallets, messaging apps, and copied secrets. **Stealc**, a malware-as-a-service infostealer marketed on Russian-speaking forums, was shown stealing browser credentials, cookies, autofill data, payment cards, cryptocurrency wallet extensions and files, Discord tokens, Telegram sessions, Steam files, Outlook credentials, and screenshots, while using anti-analysis checks, RC4-protected configuration data, and HTTP-based command-and-control to exfiltrate data and fetch second-stage payloads. Separately, Threatray linked the Rust-based Windows stealer **KuinaExtractor** to its newer **k0to** branding, finding the same malware family behind builds that steal browser data, saved credentials, gaming sessions, crypto-wallet data, Discord tokens, Windows Credential Manager data, and Wi-Fi details, while adding privilege-escalation attempts, Microsoft Defender tampering, and stronger concealment. A parallel browser-based campaign used malicious updates to the Chrome extension **"VPN Go: Free VPN"** and the Firefox extension **"Free VPN by VPN GO"** to capture clipboard contents and send them to hardcoded HTTP endpoints. Because the extensions still provided visible VPN or proxy functionality, the clipboard theft was harder for users to spot, putting copied passwords, MFA recovery codes, seed phrases, API keys, OAuth tokens, and banking details at risk. The reports advised organizations to remove the extensions, review synced browser profiles, revoke sessions, rotate exposed credentials and secrets from a clean device, and treat any Windows system that executed the stealers as a full infostealer compromise.
Jul 7, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026
Multiple threat reports describe widespread use of **clipper malware** that monitors a victim’s clipboard for cryptocurrency wallet addresses and silently replaces them with attacker-controlled values, redirecting funds during transactions. Researchers documented this behavior in standalone families and MaaS offerings including **AvD crypto stealer**, **Clipminer**, **Laplas Clipper**, **WeSteal**, **Evrial**, **Android.Clipper**, and clipper modules bundled into platforms such as **Eternity Project** and **Cinoshi**. Several operations expanded beyond simple wallet replacement to target multiple cryptocurrencies, Steam trade links, and digital payment identifiers, while some samples used lookalike wallet prefixes to reduce user suspicion. The malware has been delivered through trojanized software, cracked applications, spam attachments, phishing documents, fake developer tools, and broader malware chains that also deploy stealers, miners, RATs, botnets, or ransomware. Reports tied clipboard hijacking to campaigns involving **ViperSoftX**, **OriginBotnet**, **DarkCloud**, **Tor2Mine**, and a trojanized **dnSpy** installer, showing that clipboard abuse is often one component of larger financially motivated intrusions. MITRE tracks the underlying behavior as **`T1115` Clipboard Data**, underscoring that clipboard collection and modification remain common techniques for credential theft, fraud, and cryptocurrency theft across Windows and Android environments.
Aug 15, 2026