Loading story…
Researchers reported that Phoenix emerged as a VB.NET malware-as-a-service operation that goes beyond keylogging to steal credentials and other sensitive data from nearly 20 browsers, along with email, FTP, and chat clients. The malware also captures keystrokes and clipboard contents, takes screenshots, and can download additional payloads, while exfiltrating stolen information through SMTP, FTP, or Telegram.
Analysis found Phoenix uses layered anti-analysis and anti-detection techniques, including string encryption, obfuscation, anti-VM checks, attempts to disable Windows Defender, and an anti-AV component designed to terminate more than 80 security and analysis tools. The malware has been distributed through phishing campaigns using weaponized RTF and Microsoft Office documents exploiting CVE-2017-11882, and researchers linked it to the earlier Alpha keylogger based on similarities in code, configuration, marketing, and timeline, indicating Phoenix is a rebranded evolution of that malware family.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Cybereason reported that the Phoenix malware family first emerged at the end of July 2019. The VB.NET malware-as-a-service keylogger functioned more broadly as an infostealer and was linked to phishing delivery using weaponized Office documents.
Cybereason’s Nocturnus team published an analysis of Phoenix, detailing its credential theft, keylogging, screenshot capture, anti-analysis features, and exfiltration methods. The report also assessed Phoenix as a rebranded evolution of the earlier Alpha keylogger based on code, configuration, marketing, and timeline similarities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported active phishing operations using business-document lures and fake "secure mail" messages to infect Windows users with **VIP Keylogger** and related infostealers. Splunk said attackers sent payment notices, procurement orders, and logistics updates carrying heavily obfuscated `.vbs`, `.js`, or `.bat` loaders that launched PowerShell stagers, hid data in environment variables, and used steganography in PNG files to rebuild the final payload. K7 Labs also tracked a malware-as-a-service **VIP_Keylogger** campaign, while Splunk said the malware injects into `aspnet_compiler.exe` and steals keystrokes, screenshots, browser and Outlook credentials, clipboard contents, and cryptocurrency wallet addresses before exfiltrating data to attacker infrastructure, including Telegram. AhnLab separately detailed a South Korea-focused campaign impersonating a major credit card company with malicious LNK files that executed PowerShell and `mshta`, fetched an HTA with obfuscated VBScript, and displayed decoy documents to reduce suspicion. The malware changed behavior depending on whether Windows Defender was enabled: one path delivered AES-encrypted archives with backdoor, keylogging, clipboard theft, and information-stealing components, while the other used `rundll32` to load a downloader that avoided VBox and VMware and then pulled additional payloads from Google Drive to steal browser, email, cookie, clipboard, and cryptocurrency wallet data. Defenders were urged to scrutinize email attachments and file types, monitor suspicious registry and PowerShell activity, and watch for script-launched processes and Telegram-related DNS traffic.
Jun 29, 2026
Researchers detailed how **Snake Keylogger**—also tracked as **404 Keylogger**—continues to spread through multi-stage infection chains that begin with phishing documents or other loaders and end in credential theft, surveillance, and data exfiltration. One analyzed campaign used a malicious Microsoft Word file with VBA macros that dropped an `.inf` file into `%TEMP%` and abused `LaunchINFSectionW` from `Advpack.dll` to execute the next stage through legitimate Windows components. That chain then used built-in tools to reconstruct and launch a disguised DLL downloader, which attempted to fetch an additional payload from a remote command-and-control endpoint. Separate technical analyses describe Snake as a long-running **malware-as-a-service** operation with modular .NET payloads, in-memory decryption, steganographic extraction of components, and execution techniques including process injection and process hollowing. The malware is designed to steal browser, email, FTP, Discord, and Wi-Fi credentials; log keystrokes; capture screenshots and clipboard data; profile infected hosts; and evade analysis through anti-debugging checks and termination of security tools. Researchers also reported persistence through registry keys, startup items, or scheduled tasks, and exfiltration over channels including **Telegram**, **SMTP**, and **FTP**, while linking the family to variants such as **Matiex**, **Cheetah**, and **Nova**.
Jul 13, 2026
Researchers detailed ongoing Snake Keylogger activity in which attackers deliver the .NET-based infostealer through phishing emails carrying archive files, malicious executables, exploit-laden RTF documents abusing `CVE-2017-11882`, and Excel attachments with password-protected VBA macros. In one analyzed chain, a lure such as `SeptemberOrderlist.pdf.exe` decrypted intermediate .NET assemblies before launching the final payload, while another used base64-encoded PowerShell to download a Snake downloader, retrieve an RC4-encrypted DLL, and deploy the malware through process hollowing. Snake is designed to steal credentials and other sensitive data from more than 50 applications, including browsers, email and FTP clients, communication tools, wireless profiles, and Windows product information, while also capturing keystrokes, screenshots, clipboard contents, host details, geolocation, and time data. The malware can persist through scheduled tasks or Startup-folder registry changes, evade defenses by killing security tools, adding Windows Defender exclusions, and deleting itself, and exfiltrate stolen data over SMTP, FTP, or Telegram via HTTPS. Multiple researchers said Snake shares strong code and loader similarities with commodity stealers such as FormBook, Agent Tesla, Matiex, 404, Cheetah, and Phoenix, pointing to code reuse or shared tooling in the cybercrime ecosystem.
Aug 15, 2026