Remus Stealer advertises $1,000 Gmail access that survives resets
Hudson Rock has not verified persistence after password changes or a Gmail vulnerability.
Stories per day · 30 days
16 RSS
Relatedsupply-chain19credential-theft12clickfix9claude8github8chatgpt6litellm6powershell6pypi6rat6windows6macos5npm5aoki4aokigahara4armorsteal4cryptocurrency4docker4
240 stories, newest first · one card per story
Stories tagged #infostealer
Fake Cloudflare CAPTCHA ClickFix lures hide malware in PNG images
Huntress says pasted PowerShell rebuilt full executables from PNG pixel data, then added persistence and lateral movement.
Formbook uses localized order lures against European firms
ANY.RUN says JavaScript and PowerShell stages inject Formbook/XLoader to steal browser-stored credentials.
Binance says ShinyHunters' 335 million-record sale claim looks like a scam
The group demanded $900,000 on November 4; Binance says the sample does not match how it stores data.
1
Malicious Ruby gem steals credentials and backdoors AI coding tools
strutil-core 1.0.1 was live about five hours; revoking a stolen GitHub token can wipe the home folder.
RevStealer spreads through 100+ domains and hijacked YouTube channels
The stealer takes browser secrets, game accounts, and wallets, then deletes itself after sending the data.
4
Abe Office RAT bypasses Chrome App-Bound Encryption to steal passwords
The signed AbeAgent.exe uses a default password, injects a helper into off-screen Chrome, and was seen operating in a sandbox.
Fake GitHub security tools infect over 2,000 computers with malware
Doctor Web says Visual Studio and script repos drop AsyncRAT, a clipocurrency clipper, and a browser stealer.
Hackers log in with stolen credentials in average 8 minutes
Attackers access systems in an average of 8 minutes using stolen credentials in 27 confirmed cases, abusing AI coding tools and remote monitoring software.
1
Talos details VOLTA, a Windows infostealer that ranks loot with LLMs
The same newsletter repeats claims about Railway agents, freezer attacks in 10 countries, and a Binance theft.
1
Vercel ties sessions to devices and opens AI security reviews in beta
Full Device Bound Session Credentials support is limited to Chrome on Mac and Windows, with a less secure polyfill planned.
Marsalek Infostealer spreads fake game cheats to steal browser data
MaaS platform Marsalek distributed cheats for Roblox and Fortnite, stealing passwords cookies Discord tokens and crypto wallets from over 1,560 accounts using CMSTP UAC bypass.
2
ClickFix lures deliver Phexia malware that hides C2 via Polygon contracts
Phexia operators rotate C2 addresses by updating smart contracts; defenders should hunt Terminal commands and LaunchAgents.
Gorbag APT exploits WinRAR CVE-2025-8088 to deploy BeautyStealer
Russia-aligned Gorbag APT deploys BeautyStealer infostealer via WinRAR flaw in spearphishing emails against Ukrainian law enforcement and government targets.
Infostealer Malware Harvests ChatGPT and Claude Tokens
WardenStealer and Aoki steal AI developer credentials like session tokens and API keys, allowing unauthorized access post password reset.
1
Infostealers target ChatGPT Claude API tokens
WardenStealer and Aoki collect AI authentication tokens that survive password resets.
2
Russia-aligned Gorbag targets Ukrainian organizations with infostealer
Gorbag used spearphishing and WinRAR exploits to harvest credentials and documents from Ukrainian justice, law enforcement and defense entities.
VOLTA infostealer uses AI to rank victims by value
The malware deletes itself after collecting data and forwards AI-ranked victim profiles via Telegram.
1
New infostealer VOLTA-AUTODOXER ranks stolen data by AI profitability
The malware sends a structured bundle of victim data to AI models which rank assets by monetization potential and assess security habits.
1
VOLTA Malware Steals Gmail and Discord Sessions Using AI to Build Victim Profiles
The VOLTA-AUTODOXER infostealer steals sessions and uses OpenRouter AI to draft forensic victim profiles ranking valuables and opsec.
1
VOLTA Infostealer Uses Claude, Gemini and Kimi AI to Rank Victims
VOLTA builds evidence bundles and feeds them to Claude Opus 4.6, Gemini 2.5 Flash and Kimi K2 via OpenRouter to generate monetization-ranked Telegram dossiers.
1
VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims
The malware outsources victim profiling and asset ranking to commercial AI models after harvesting credentials and sessions.
1
VOLTA infostealer uses LLMs to rank victims by monetization value
The self-deleting Windows stealer posts a structured dossier to OpenRouter and fails over across three models if one refuses.
2
DeceptiveDevelopment poisons repos after stealing developer credentials
ESET says the group planted code on npm, PyPI, Packagist, Go modules, and extension stores from April to September 2026.
1