Loading story…
Researchers analyzed a Rust-based information stealer targeting Windows systems that harvested data from Chromium-based browsers, Discord, Steam, and multiple cryptocurrency wallets. The malware used anti-debugging checks, staged stolen files in directories disguised as Microsoft security paths, and compressed the collected data into a ZIP archive before exfiltration.
The sample uploaded the archive to gofile.io and then attempted to send a JSON summary of the victim and stolen data to an attacker-controlled GitHub Codespaces endpoint on port 8080. Investigators found the webhook attempt failed with an HTTP 302 response, but the Gofile archive remained publicly accessible without authentication, and code similarities suggested the stealer was based on or inspired by a publicly available Rust stealer repository on GitHub.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro documented a Rust-based Windows information stealer that collected browser, Discord, Steam, and cryptocurrency wallet data, uploaded a ZIP archive to gofile.io, and attempted to send a JSON summary to an attacker-controlled GitHub Codespaces endpoint on port 8080. In the analyzed sample, the Codespaces exfiltration attempt failed with an HTTP 302 response while the gofile.io archive remained publicly accessible.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Collector Stealer**—also marketed as **COLLECTOR Project**, **CollectorGoomba**, and formerly **Memory Project**—was sold as a Russian-language spyware service and used to steal saved browser credentials, cookies, personal data, screenshots, Telegram and Steam data, and cryptocurrency wallet information from infected Windows systems. Researchers said the malware was spread through phishing portals, fake software downloads, and bundled crack or riskware tools such as **KMSAuto**, often disguised as miners, game utilities, or activation packages. On infected hosts, it gathered data from browsers and applications, captured screenshots, scanned directories, extracted SQLite-stored information, and staged the loot in **ZIP** or **RAR** archives before sending it to attacker-controlled panels over HTTP POST. Analysis of the malware’s infrastructure showed that some builds fetched their command-and-control destination from a text file hosted on **GitHub**, with a fallback to a hard-coded `justns.ru` subdomain if retrieval failed. After the malicious GitHub repository was reported and removed, affected samples attempted to exfiltrate to an invalid `404: Not Found.ru` destination and crashed, temporarily disrupting those variants. Operators later updated newer samples to use **upaste[.]me** for C2 redirection instead, indicating the stealer remained under active development and continued to evolve its exfiltration workflow and delivery ecosystem.
Aug 15, 2026
Threat researchers uncovered multiple malware campaigns abusing trusted developer and AI distribution platforms to spread **Rust-based infostealers** through fake or typosquatted repositories. HiddenLayer found that a malicious Hugging Face project, `Open-OSS/privacy-filter`, impersonated OpenAI’s legitimate Privacy Filter repository, briefly became the platform’s top trending project, and was downloaded about **244,000** times before removal. The repository’s `loader.py` fetched a multi-stage payload ending in the `sefirah` infostealer, which harvested browser data, Discord tokens, cryptocurrency wallet data, SSH/FTP/VPN credentials, local files, system details, and screenshots, then exfiltrated the data to `recargapopular[.]com`. Researchers also linked the activity to overlaps with an npm typosquatting campaign associated with the **WinOS 4.0** implant. In a parallel campaign, Netskope reported that attackers impersonated the OpenClaw project with a fake installer site and a typosquatted GitHub organization to deliver a previously undocumented Rust dropper called **Hologram** and a modular implant framework. The malware targeted credentials from more than **250** cryptocurrency wallet, password manager, and 2FA browser extensions, while using anti-sandbox checks, in-memory .NET execution, reflective PE loading, persistence via `Userinit`, COM hijacking, and scheduled tasks, plus direct NT syscall thread injection. Operators staged and relayed infrastructure through legitimate services including **Azure DevOps, Telegram, Hookdeck, snippet.host, and Pastebin**; Netskope said the operation marked the first documented malware abuse of Hookdeck as a C2 relay and later evolved into a third wave, **Pathfinder**, that added confirmed Vidar infostealer delivery.
Jun 29, 2026
The source code for **Titan Stealer**, a Windows information-stealing malware family sold through a Russian-language Telegram channel, was publicly exposed on GitHub, where a repository advertised the **full server, client, and admin panel**. The leaked project was described as written in **C#/.NET** with a **PHP** administration panel and promoted capabilities to harvest data from more than **70 browsers** and **70 cryptocurrency wallets**, alongside file-grabber functions and server-side decryption. Security research shows Titan Stealer uses a **32-bit GCC-compiled loader** to decrypt an embedded **Golang** payload and inject it into `AppLaunch.exe` via process hollowing. Once active, it steals browser credentials, cryptocurrency wallet data, **Telegram Desktop** artifacts, FTP client details, screenshots, system information, and selected files, then exfiltrates the data to command-and-control infrastructure as a **base64-encoded archive**. Researchers said the operators actively maintained the malware, marketed updates and bug fixes, and used a dedicated panel to review victim logins and stolen data.
Aug 15, 2026