Loading story…
The source code for Titan Stealer, a Windows information-stealing malware family sold through a Russian-language Telegram channel, was publicly exposed on GitHub, where a repository advertised the full server, client, and admin panel. The leaked project was described as written in C#/.NET with a PHP administration panel and promoted capabilities to harvest data from more than 70 browsers and 70 cryptocurrency wallets, alongside file-grabber functions and server-side decryption.
Security research shows Titan Stealer uses a 32-bit GCC-compiled loader to decrypt an embedded Golang payload and inject it into AppLaunch.exe via process hollowing. Once active, it steals browser credentials, cryptocurrency wallet data, Telegram Desktop artifacts, FTP client details, screenshots, system information, and selected files, then exfiltrates the data to command-and-control infrastructure as a base64-encoded archive. Researchers said the operators actively maintained the malware, marketed updates and bug fixes, and used a dedicated panel to review victim logins and stolen data.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository advertised as an official leak of the full Titan Stealer source code was made publicly available, claiming to include the server, client, and admin panel components. The repository described the malware as written in C#/.NET with a PHP admin panel and promoted capabilities such as stealing from more than 70 browsers and 70 cryptocurrency wallets.
Uptycs researchers published an analysis of Titan Stealer, describing it as an information-stealing malware family marketed through a Russian-language Telegram channel and detailing its Windows-focused theft and exfiltration behavior. The report also documented technical details including its loader, Golang payload, process hollowing into AppLaunch.exe, and associated C2 infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceuptycs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Bandit Stealer**, a Go-based information stealer for Windows that collects browser credentials, cookies, history, credit card data, cryptocurrency wallet contents, Telegram sessions, FTP and email client logins, keystrokes, clipboard data, and host profiling information. The malware attempts privilege escalation with `runas.exe`, establishes persistence through the Windows **Run** registry key, and stores stolen data in `%appdata%\local` subfolders named with the victim’s country code and IP address before archiving and exfiltrating the loot through the **Telegram Bot API**. Bandit Stealer also uses extensive anti-analysis and sandbox-evasion checks to avoid detection, inspecting virtualization and security processes, debugger presence, blacklisted IP addresses, MAC addresses, hardware IDs, usernames, and computer names, and terminating when it detects likely research environments. Researchers said the malware has been delivered through self-extracting archive droppers disguised as benign documents or installers, including decoy Word, OpenVPN-related, and fake Heartsender files, while embedded Linux paths and commands suggest the codebase may still be evolving or could expand beyond Windows.
Aug 15, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026
**Stealc**, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures. Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.
Sep 9, 2026