Loading story…
EvilExtractor was observed in phishing campaigns as a Windows-focused info stealer that collects browser cookies, history, cached passwords, system details, Wi-Fi data, screenshots, selected files, keystrokes, and webcam captures from infected hosts. Researchers found the malware packaged in PyInstaller-based Python code or delivered through a .NET loader, with anti-analysis features including anti-VM, anti-sandbox, hostname checks, and date-based execution controls. Fortinet also reported that the malware family includes a ransomware component, Kodex Ransomware, which uses 7za.exe to create password-protected archives before dropping a ransom note.
Network analysis showed EvilExtractor operating autonomously after execution: it first checked the victim’s public IP, downloaded an additional archive named KK2023.zip from 193.42.33.232, and then connected to an attacker-controlled FTP server at 89.116.53.55 using hardcoded credentials to upload stolen data while preserving the victim’s directory structure. Additional modules, including Confirm.zip and MnMs.zip, were later retrieved to enable keylogging and webcam capture, and one observed execution also exfiltrated the malware archive itself from the victim desktop. Researchers said most observed victims were in Europe and the Americas and published related IOCs including infrastructure details and file hashes.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs observed EvilExtractor being distributed in a phishing email campaign on 30 March using an attachment disguised as an account confirmation file with an Adobe PDF icon. One observed payload was the PyInstaller-packed executable Account_Info.exe.
FortiGuard Labs observed a significant increase in malicious activity tied to evilextractor[.]com in March 2023, indicating broader operational use of the malware infrastructure.
A later ANY.RUN execution of the same EvilExtractor sample showed similar theft behavior and additionally exfiltrated the archive vv9wvsfb2v_pw_infected.zip, which contained the malware executable itself.
In the analyzed execution, EvilExtractor connected to FTP server 89.116.53.55 with hardcoded credentials and uploaded browser cookies, history, cached passwords, system details, Wi-Fi data, and selected files. The malware created victim-specific directories and preserved the local folder structure on the FTP server.
A sandbox PCAP analyzed by Netresec showed EvilExtractor checking the victim's public IP, downloading KK2023.zip from 193.42.33.232, and later retrieving Confirm.zip and MnMs.zip. The downloaded components were identified as browser-data theft, keylogger, and webcam modules.
FortiGuard Labs published analysis describing EvilExtractor as a Windows-focused info stealer used in phishing campaigns, with anti-analysis checks, FTP-based exfiltration, and an included Kodex Ransomware capability. The report also published infrastructure and file indicators.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a newly identified malware-as-a-service operation called **Evil Stealer** after its backend infrastructure was left exposed on Njalla-hosted systems, including an unauthenticated status API on port `8888` and a raw Next.js panel on port `3000`. The exposed API revealed a sequential counter showing **310,194 processed credential logs** within roughly six days, while the panel’s JavaScript also contained a cryptocurrency wallet drainer. Investigators linked the operation to domains including `evilmirror[.]net` and `ofmhubintel[.]com`, the latter tied to an **OnlyFans creator scraper**, indicating the actor was pursuing multiple monetization streams beyond credential theft. The operator was identified with high confidence through poor operational security in a promotional video whose unstripped XMP metadata exposed the Windows username **"moros"**, a Russian-language filename, and timestamps consistent with **UTC+3 / Moscow time**. Additional artifacts, including Russian keyboard indicators, shared registrar and hosting details, matching SSH HASSH fingerprints, and common Ubuntu templates, supported the assessment that the same Russian-speaking actor ran the linked infrastructure. Researchers also observed nearby suspicious services on the same hosting environment, including phishing and TLS interception infrastructure, although attribution for those adjacent systems was weaker; the malware payload and delivery chain for Evil Stealer itself had not yet been publicly identified.
Jun 29, 2026
Researchers reported that the **X-FILES/XFiles Reborn** infostealer was delivered through campaigns abusing the Microsoft **Follina** vulnerability, adding another distribution path alongside phishing sites posing as legitimate software. The malware is a **C#-based stealer** that uses a downloader shellcode to retrieve and execute payloads from the same command-and-control server, with infrastructure linked to Russian-hosted phishing pages and a Russian-hosted C2 panel. Once executed, the stealer collects a wide range of victim data, including browser credentials, financial and credit card data, cryptocurrency wallet information, FTP credentials, **Telegram** data, **Discord** tokens, **Steam** information, screenshots, and selected `.txt` and `.pdf` files. Newer variants were found to create working folders such as `%APPDATA%`, store stolen content in `Grabber` and `Browsers` directories, write host details to `PCInfo.txt`, dynamically pull wallet target paths from C2, crawl directories for browser theft, steal both **FileZilla** and **WinSCP** data, and exfiltrate results to command-and-control servers in **JSON** format with improved obfuscation over earlier versions.
Aug 15, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026