MalwarePublished 22 May 2025

PupkinStealer .NET Infostealer Using Telegram for Data Theft

Source AlienVault OTX General

Description

PupkinStealer is a newly identified .NET-based information-stealing malware that extracts sensitive data like web browser passwords and app session tokens, exfiltrating it via Telegram. It targets Chromium-based browsers, Telegram, and Discord, focusing on credential theft and session hijacking. The malware performs minimal system discovery, collects files from the desktop, and captures a screenshot. It packages stolen data into a ZIP archive and sends it to the attacker through Telegram's Bot API. PupkinStealer doesn't employ persistence mechanisms, relying on quick execution and low-profile behavior. Its primary evasion technique is leveraging legitimate Telegram infrastructure for communication.

Impact

For European organizations, PupkinStealer presents a significant risk through credential theft and session hijacking, potentially leading to unauthorized access to corporate and personal accounts. Given the widespread adoption of Chromium-based browsers and messaging platforms like Telegram and Discord across Europe, the malware can facilitate lateral movement within networks if stolen credentials grant access to internal systems or cloud services. The theft of session tokens is particularly concerning as it may bypass multi-factor authentication mechanisms, enabling attackers to impersonate users without triggering standard security alerts. The malware’s capability to collect desktop files and screenshots further increases the risk of sensitive data exposure, including intellectual property and confidential communications. Although PupkinStealer lacks persistence, its quick execution and stealthy communication via Telegram’s infrastructure make detection challenging, potentially allowing attackers to exfiltrate valuable data before remediation. Organizations with remote or hybrid workforces relying on these applications are especially vulnerable. Sectors with high-value targets such as finance, government, and critical infrastructure could face targeted attacks leveraging this malware to gain initial footholds or escalate privileges. The medium severity rating reflects that while the malware is not causing widespread disruption currently, its capabilities warrant proactive defense measures to prevent credential compromise and data leakage.

Defensive guidance

To effectively mitigate PupkinStealer, European organizations should implement targeted and practical controls beyond standard cybersecurity hygiene. First, enforce strict credential management policies including regular password changes and the use of password managers to minimize credential reuse and theft risk. Deploy advanced endpoint detection and response (EDR) solutions capable of monitoring process behaviors, specifically looking for unusual use of Telegram’s Bot API or unexpected creation and transmission of ZIP archives. Network monitoring should incorporate anomaly detection focused on Telegram traffic patterns, especially outbound connections to Telegram Bot endpoints that deviate from normal user activity profiles. Implement application whitelisting to restrict execution of unauthorized .NET binaries and scripts, reducing the attack surface. User education campaigns should emphasize the risks of downloading and executing unknown files, particularly those masquerading as messaging or browser extensions. Employ multi-factor authentication (MFA) with adaptive risk-based policies to detect and block suspicious session hijacking attempts. Regularly audit desktop file shares and restrict access to sensitive files to minimize data exposure. Finally, maintain updated threat intelligence feeds and integrate provided indicators of compromise (IOCs), such as the known file hashes, into security tools to enable rapid detection and response to PupkinStealer infections.

PupkinStealer .NET Infostealer Using Telegram for Data Theft

Description

Impact

Defensive guidance

Indicators of compromise

Hashes 3

Community reviews

Description

AI analysisMachine-generated, updated 22 Jun 2025, 03:51 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

Hashes 3

Community reviews

Related threats