Loading story…
Researchers at K7 Security Labs identified a Python-based malware-as-a-service-style infostealer builder that lets operators configure a webhook and generate customized Windows payloads. The payload steals saved passwords, payment-card records, cookies, browsing history, Discord tokens, Roblox session cookies, Wi-Fi passwords, and host, location, and system-profile data. It targets 17 Chromium-based browsers and collects Firefox cookies and history, using browser encryption keys and Windows Data Protection API functions to recover protected browser data.
The malware archives stolen data in memory and exfiltrates it to the configured webhook, whose configuration is obscured with XOR and Base64 encoding. Payloads can be compiled with Nuitka or PyInstaller and evade analysis through debugger, virtual-machine, disk-size, and delayed-library-loading checks. It persists through both a Windows Run registry value and a scheduled task triggered at logon; researchers have not confirmed its delivery mechanism, operators, victim count, or infection scope.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
K7 Security Labs analyzed a nested archive containing a Python-based malware-as-a-service-style builder and its Windows infostealer payload. The builder lets operators configure webhook-based exfiltration and generate payloads targeting browser data, Discord and Roblox tokens, Wi-Fi passwords, and host information, with anti-analysis and persistence capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported a new **Python-based Windows information-stealing malware** dubbed **SolyxImmortal** that emphasizes *stealth and long-term persistence* over destructive actions. The implant is described as a “monolithic” package (not modular), delivered as a legitimate-looking Python script (e.g., `Lethalcompany.py`), and runs quietly in the background to harvest sensitive data including credentials, documents, keystrokes, and screenshots. SolyxImmortal’s command-and-control and exfiltration model relies on **Discord webhooks**, abusing trusted HTTPS traffic to blend in and reduce network-based detection. Reporting attributes the analysis to **CYFIRMA**, noting that C2 parameters are hardcoded and that operators can receive real-time notifications (including via a hardcoded Discord user ID) for high-value events; separate webhooks may be used for different data types (e.g., logs/files vs. screenshots). The malware targets browser-stored data (including Chromium-based browsers such as Chrome, Edge, Brave, and Opera GX) and focuses on single-host surveillance rather than lateral movement.
Jun 29, 2026
Researchers detailed **Vanta Stealer**, a Python-based information-stealing malware for Windows that rapidly collects a wide range of data from infected systems. The malware is packaged with **PyInstaller** and obscured with multiple **PyArmor** layers, then uses a modular design that can download a dedicated browser extractor during execution. Reported targets include Chromium-based browsers, stored credentials, cookies, payment data, Discord tokens, Steam, Roblox, Riot Games, Valorant, Minecraft, Telegram Desktop, Mullvad VPN, cryptocurrency wallet files and recovery material, private documents, screenshots, and webcam images. After harvesting data, Vanta Stealer logs the results in `Summary.txt`, compresses the stolen files into a ZIP archive, and sends the archive with victim metadata to a predefined command-and-control endpoint over HTTP POST. Reporting on the malware said likely delivery methods include phishing attachments, fake installers, cheats, bogus software updates, tampered code repositories, and malicious search ads, and noted that defenders should watch for unusual archive uploads and restrict unapproved software while affected users reset passwords, revoke sessions, and review wallet exposure from a clean device.
Aug 6, 2026
**Arkanix Stealer** emerged as a previously undocumented infostealer offered under a **malware-as-a-service (MaaS)** model, promoted via dark web forum advertisements that directed buyers to a Discord server for coordination. Analysis identified multiple implants, including a native **C++** variant with broad data-theft capabilities (e.g., system profiling and **cryptocurrency wallet** theft) and a **Python** implementation that can dynamically modify its configuration and is often packed to hinder analysis. The toolset also incorporated *ChromElevator*, a publicly available browser post-exploitation utility, and detections were mapped to families such as `Trojan-PSW.Win64.Coins.*` and `Trojan.Python.Agent.*`; the associated affiliate/referral program appeared to have been taken down, suggesting a short-lived operation. Separately, January 2026 telemetry and case analysis on infostealer distribution highlighted ongoing, high-volume delivery via **crack/keygen camouflage** and **SEO poisoning**, with prominent families including **LummaC2**, **Vidar**, and **ACRStealer**. The reporting emphasized automated collection and analysis pipelines that extract C2/IOC data and support near-real-time blocking via an indicator service, underscoring that infostealer operations continue to rely on scalable distribution and obfuscation techniques even as individual MaaS offerings like Arkanix may be transient.
Jun 29, 2026