Loading story…
Cisco Talos and BleepingComputer reported that ZingoStealer, a new .NET-based information stealer promoted by the Haskers Gang, was released for free in Russian-speaking cybercrime channels, increasing the likelihood of broad criminal adoption. The malware has been distributed through lures including game cheats, cracks, key generators, pirated software, and YouTube-hosted bait, primarily targeting home users while avoiding infections in CIS countries. Researchers said the operation also relied heavily on Telegram for build distribution, log handling, and exfiltration support.
ZingoStealer collects browser data, host and system information, collaboration-platform tokens, cryptocurrency wallet extensions and wallet files, and desktop files, then archives the data and exfiltrates it to attacker-controlled infrastructure. Researchers also found that it functions as a loader for additional payloads, most notably RedLine Stealer and an XMRig-based Monero miner known as ZingoMiner, giving operators multiple ways to monetize compromised systems. Talos further noted that the group offered an ExoCrypt crypter service to help evade antivirus detection, and that the malware author was later seen transferring ownership of the project and offering the source code for sale.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
An update dated 2022-04-14 stated that ownership of the ZingoStealer project was being transferred to a new threat actor for further development. Cisco Talos and BleepingComputer both reported the change in control after the source-code sale offering.
In March 2022, Haskers Gang introduced ZingoStealer in the wild and offered the .NET infostealer for free in its Telegram and Discord communities. The malware was promoted in Russian-speaking cybercrime channels as a ready-to-use stealer.
Cisco Talos said Haskers Gang has been active since at least January 2020. The group later used Telegram and Discord to distribute tooling and coordinate activity.
The malware author offered to sell the ZingoStealer source code for $500, negotiable. This sale attempt was later linked to a transfer of the project to another threat actor.
A recent ZingoStealer release added XMRig-based Monero mining capability as another monetization path. Talos observed delivery of an XMRig injector, and BleepingComputer noted the malware used PowerShell to add Defender exclusions and run the miner.
Cisco Talos observed ZingoStealer downloading and executing additional malware from attacker-supplied URL lists. The most common second-stage payload observed was RedLine Stealer.
Threat actors offered a pre-built ZingoStealer option bundled with the ExoCrypt crypter for 300 rubles. This service was intended to help evade antivirus detection.
After its release, ZingoStealer was spread through software cracks and video game cheats, including promotions on YouTube. These lures primarily targeted home users.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcebleepingcomputer.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026
Zloader, a **ZeuS-derived banking trojan** that steals browser data, cookies, passwords, screenshots, and other host information, was used in multiple campaigns that combined layered delivery chains with strong evasion and persistence. Researchers documented malspam operations using **MHTML attachments**, password-protected XLS files, VBA and XLM macros, and `rundll32.exe`, as well as a later campaign that used the legitimate RMM tool **Atera** for initial access. In that operation, attackers weakened Microsoft Defender, disabled investigation tools, and abused a weakness in **Microsoft Authenticode** by appending malicious script content to Microsoft-signed DLLs while preserving a seemingly valid signature, then launching the script with `mshta.exe` and executing Zloader through `regsvr32.exe`. Across samples, Zloader commonly injected its core payload into a suspended `msiexec.exe` process, stored encrypted configuration data, and maintained persistence through Startup-folder scripts and Windows Run keys. Technical analyses showed Zloader evolving into a **modular malware platform** with anti-analysis features including encrypted strings, runtime API resolution, filename checks, process injection, and heavy **API hammering** that can generate more than a million file or registry-related calls before payload execution. Newer variants retained RC4-encrypted configuration data but added revised domain-generation logic and network protections using **RSA**, **RC4**, and Zeus BinStorage-style encryption over HTTP POST. Microsoft, ESET, Lumen Black Lotus Labs, Palo Alto Networks Unit 42, and others later disrupted three Zloader botnets by seizing **65 active command-and-control domains** and **319 DGA-generated domains**, while reporting that the malware had been tracked since 2019 across roughly **14,000 unique samples** and more than **1,300 C2 servers**, with some affiliates tied to **DarkSide ransomware**, **Cobalt Strike**, **Raccoon infostealer**, and large victim populations in North America.
Aug 15, 2026