Not Safe for Work: Tracking and Investigating Stealerium and Phantom Infostealers

Proofpoint researchers have observed an increase in cybercriminals using Stealerium-based malware, an open-source infostealer available on GitHub. Multiple stealers share code with Stealerium, including Phantom Stealer. Campaigns delivering Stealerium have used various lures and file types, targeting industries like hospitality, education, and finance. The malware can exfiltrate a wide range of data, including browser credentials, credit card info, and crypto wallet data. It uses anti-analysis techniques and can exfiltrate data through multiple channels like SMTP, Discord, and Telegram. The rise in Stealerium usage reflects the growing trend of threat actors pivoting to information stealers as identity theft becomes a priority.

• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• LiteLLM supply chain compromiseCampaign2026-10-22
• Aoki: Infostealer Targets AI Coding Assistant CredentialsMalware2026-10-15
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Akira Ransomware Attack InvestigationMalware2026-10-07