Loading story…
Proofpoint reported that Ovidiy Stealer, a previously undocumented credential-theft malware family, was being actively sold and used in the wild, primarily in Russian-speaking cybercrime markets. The malware was advertised as a low-cost, modular tool and was observed in multiple rapidly updated versions, including 1.0.1 through 1.0.5, suggesting active development and broad accessibility for lower-skilled threat actors.
Ovidiy Stealer was distributed through malicious email attachments, direct executable downloads, and software-lure bundles such as fake installers. Once executed, it harvested credentials from web browsers and FileZilla and exfiltrated the data over SSL/TLS to the command-and-control domain ovidiystealer[.]ru. Proofpoint said the malware lacked persistence and stayed in its installation directory, appeared to reuse code from the open-source LiteHTTP Bot project, and was allegedly authored by an actor using the handle "TheBottle", with the same domain serving both as the malware sales portal and operational C2 infrastructure.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Proofpoint observed original Ovidiy Stealer credential-stealing malware samples in the wild beginning in June 2017. The malware was previously undocumented and appeared to be marketed primarily in Russian-speaking regions.
By the time of its analysis, Proofpoint had seen Ovidiy Stealer versions 1.0.1 through 1.0.5 in circulation, indicating active development. The report also documented its distribution via malicious attachments, executable downloads, and software-lure bundles.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that **Nocturnal Stealer**, a low-cost information-stealing malware sold on an underground forum for **1,500 Rubles** (about **$25**), was observed being deployed in the wild by an unknown loader. The malware targets **Chromium- and Firefox-based browsers**, **cryptocurrency wallets**, and **FileZilla** FTP credentials, harvesting stored usernames, passwords, cookies, autofill data, payment card details, wallet information, and host system data. The stealer stages stolen data locally and exfiltrates it to a command-and-control server over **HTTP POST** requests using the `User-Agent` string `Nocturnal/1.0`. Proofpoint said the malware includes basic anti-analysis features, including anti-VM checks, queries `ip-api.com` to identify the victim's external IP address and country code, and deletes dropped files after sending the data. Researchers assessed the malware as relatively unsophisticated, but warned that its low price and broad credential theft capabilities make it accessible to low-skill criminals and potentially damaging at scale.
Jun 29, 2026
Researchers analyzing multiple **Vidar Stealer** samples found the malware relies heavily on encrypted or XOR-obfuscated strings and dynamic API resolution to conceal its behavior. Reverse engineering with **Ghidra** and **x32dbg** exposed decrypted strings tied to `LoadLibraryA`, `GetProcAddress`, `VirtualAlloc`, anti-analysis checks, and broad data-theft functions. The recovered functionality shows Vidar harvesting browser passwords, cookies, autofill data, credit cards, Firefox/NSS secrets, FileZilla and WinSCP data, Steam files, Discord and Telegram artifacts, screenshots, host metadata, and numerous desktop and browser-extension cryptocurrency wallets. A separate campaign analysis showed Vidar configured to treat some stolen data differently when credentials were associated with hostnames linked to government, military, police, intelligence, CERT, and NATO-related organizations in Poland and the Baltic region. In that sample, the malware decrypted a hardcoded hostname list, checked stolen credentials for matches, and redirected matching data to an alternate command-and-control path, while command-and-control addresses were retrieved from Mastodon profiles including **@oleg98** and **@artemida**. The reporting also linked the broader activity to infrastructure or samples associated with **Raccoon**, **RedLine Stealer**, **SmokeLoader**, and **STOP ransomware**, indicating a wider criminal ecosystem around the campaign.
Aug 15, 2026
Threat actors are continuing to prioritize **credential theft** while using defensive and trusted services to evade detection. DomainTools reported a Microsoft 365 phishing operation that **weaponizes Cloudflare protections** (including *Turnstile* human verification) to block automated analysis and security crawlers, then selectively serves a credential-harvesting flow only to “clean” visitors. The infrastructure used additional gatekeeping such as IP reputation checks (including lookups via `api.ipify.org`), hardcoded blocks for security-vendor and cloud-provider ranges, and user-agent filtering that returns a fake `404` page to bots, with the theft logic hidden behind heavy obfuscation. Separately, Hunt.io documented **Operation Roundish**, assessed with medium-high confidence as aligned to **APT28 (Fancy Bear)**, after discovering an exposed open directory hosting a Roundcube exploitation toolkit used against Ukrainian targets (including `mail.dmsu.gov.ua`). The toolkit included XSS payloads, a Flask-based C2, and modules for credential harvesting, mail forwarding persistence, bulk email exfiltration, address book theft, and 2FA secret extraction, plus a Go-based Linux implant (`httd`) found on a compromised Ukrainian web application. In parallel reporting on credential-access tradecraft, Flashpoint analysis highlighted the low-cost **DarkCloud infostealer** (sold for about **$30**) that steals browser logins/cookies and other data and exfiltrates via common channels (email/FTP/Telegram/HTTP), while Aryaka Threat Labs described the **BlackSanta** campaign using steganographic lures and **BYOVD** techniques to disable EDR and enable stealthy data theft over HTTPS—underscoring that credential access and defense evasion remain common precursors to broader enterprise compromise.
Jul 1, 2026