Titan Stealer Source Code Leak Exposes Full Info-Stealer Toolkit
Malware Intelligence · 2 sources · Updated 2mo ago · First seen Aug 10, 2023
The source code for Titan Stealer, a Windows information-stealing malware family sold through a Russian-language Telegram channel, was publicly exposed on GitHub, where a repository advertised the full server, client, and admin panel. The leaked project was described as written in C#/.NET with a PHP administration panel and promoted capabilities to harvest data from more than 70 browsers and 70 cryptocurrency wallets, alongside file-grabber functions and server-side decryption.
Security research shows Titan Stealer uses a 32-bit GCC-compiled loader to decrypt an embedded Golang payload and inject it into AppLaunch.exe via process hollowing. Once active, it steals browser credentials, cryptocurrency wallet data, Telegram Desktop artifacts, FTP client details, screenshots, system information, and selected files, then exfiltrates the data to command-and-control infrastructure as a base64-encoded archive. Researchers said the operators actively maintained the malware, marketed updates and bug fixes, and used a dedicated panel to review victim logins and stolen data.
