Loading story…
Researchers reported that the SYS01 information stealer has been active since at least 2022, targeting Facebook business and advertising accounts through social-engineering lures delivered by fake Facebook profiles, Google ads, and ZIP archives masquerading as games, adult videos, movies, and cracked software. The malware is also tracked as Album Stealer or S1deload Stealer, and campaigns have used compromised Facebook pages to distribute malicious archives that lure victims into launching the infection chain.
SYS01 typically abuses DLL sideloading with legitimate signed applications, then deploys an Inno Setup installer and PHP-based payloads, with newer variants adding Rust and Python components and heavier obfuscation. Researchers said it steals browser credentials, cookies, Facebook session tokens, and business-account data, while also maintaining backdoor capabilities to download and run additional payloads, upload files, execute commands, and update itself from command-and-control infrastructure. The findings underscore how stealer malware continues to enable account takeover, fraud, and broader follow-on compromise.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Morphisec began tracking SYS01 stealer in November 2022. Its analysis linked the malware to Facebook-focused credential and session theft and multiple delivery chains including DLL sideloading.
Morphisec said the SYS01 stealer campaign was first seen in May 2022. The campaign targeted Facebook business accounts using social-engineering lures and malicious ZIP downloads.
Securelist reported that Sys01 had existed since at least 2022 and had evolved from a C# stealer to a PHP stealer. The analyzed campaign used malicious ZIP archives promoted via compromised Facebook pages and DLL sideloading to deploy payloads.
Securelist reported that Acrid, a new 32-bit C++ stealer using the Heaven’s Gate technique, was found in December. The malware steals browser data, cryptocurrency wallets, selected files, and application credentials before exfiltrating them to its C2 server.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 35 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors used fake Facebook job advertisements and impersonation content, including lures themed around Amazon CEO Andy Jassy and DocuSign, to distribute the Windows information stealer **Ov3r_Stealer**. Trustwave SpiderLabs found victims were redirected to Discord-hosted `.url` shortcut files and, in some cases, weaponized PDFs, which triggered a multi-stage infection chain involving `control.exe`, malicious `.cpl` loaders, PowerShell scripts fetched from GitHub, and a final DLL sideloading payload delivered from a remote SMB share. Once installed, **Ov3r_Stealer** established persistence through scheduled tasks running every 90 minutes and harvested browser credentials, crypto wallets, FTP and Discord data, documents, and system information before exfiltrating the data to attacker-controlled Telegram bots and channels. Researchers said the malware was under active development, with alternate delivery methods including HTML smuggling, SVG smuggling, and LNK masquerading, and noted strong similarities to the open-source **Phemedrone Stealer**; the activity was linked to aliases including **Liu Kong**, **John Macollan**, **MR Meta**, and **MeoBlackA**, with indications the operator may be offering the malware as a service.
Aug 14, 2026
Multiple reports highlight active **Windows-focused malware** operations centered on credential theft and payload delivery. **Socelars** is described as a stealthy infostealer that prioritizes harvesting browser-stored session cookies and authentication artifacts (notably targeting *Facebook Ads Manager* sessions) to enable account takeover and fraud; it is reportedly distributed via fake websites posing as legitimate software (e.g., a PDF reader) and uses staged execution including system reconnaissance and a **UAC bypass via COM auto-elevation** before extracting browser session data for exfiltration. Separately, research details how established malware delivery ecosystems are evolving. Zscaler ThreatLabz reports **GuLoader (CloudEye)** increasingly abuses legitimate cloud services (e.g., *Google Drive* and *OneDrive*) to blend malicious downloads into normal traffic, while using polymorphism and control-flow obfuscation plus layered decryption to hinder analysis and deliver follow-on payloads such as RATs and stealers. Bitdefender reports a resurgence of **LummaStealer** despite prior law-enforcement disruption, attributing continued scale to social-engineering-heavy distribution (fake cracks/downloads and **fake CAPTCHA/“ClickFix”** lures) and the use of **CastleLoader** for modular, in-memory execution and obfuscated delivery; the report notes infrastructure overlap suggesting coordination or shared providers. A separate Unit 42 incident-response writeup on **Muddled Libra (Scattered Spider/UNC3944)** describes a distinct intrusion tradecraft involving unauthorized access to a *VMware vSphere* environment and a rogue VM used for reconnaissance, persistence, and interaction with enterprise infrastructure, and is not part of the infostealer/loader activity described in the other items.
Jun 29, 2026
DuckTail is a financially motivated malware operation linked to Vietnamese threat actors that targets people with access to **Facebook Business** and advertising accounts, especially marketing and advertising professionals. Researchers said the group commonly uses fake LinkedIn job offers, recruiter impersonation, spear-phishing emails, and bogus marketing or AI-themed websites to deliver malicious archives, often hosted on public cloud services, Trello, or shortened-link infrastructure. Victims are persuaded to open Windows archive files and manually launch malware disguised as documents or job materials, sometimes with decoy files or even instructional videos to improve infection success. Once executed, DuckTail steals browser cookies and abuses already authenticated Facebook sessions to take over accounts and add attacker-controlled access to business assets. Multiple variants have been observed, including large **.NET** executables, **LNK** files that trigger obfuscated PowerShell, Delphi-based loaders, malicious browser extensions, and deployments of commodity stealers such as **Doenerium** and **Vidar**. The malware has used Telegram for exfiltration and command-and-control, fake or Vietnamese-linked code-signing certificates, and infrastructure tied to Vietnam; one campaign also used Facebook API requests and the `2fa[.]live` service to help bypass two-factor authentication, with detections spanning India, Europe, Asia, the Middle East, and the Americas.
Aug 15, 2026