Fake Mac fixes trick users into installing new Shamos infostealer
Source: https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/
The ClickFix social engineering technique has gained popularity among threat actors, targeting thousands of devices globally. It tricks users into executing malicious commands on their devices by exploiting their tendency to solve minor technical issues. The technique often impersonates legitimate brands and combines with delivery vectors like phishing and malvertising. ClickFix campaigns typically lead users to a visual lure, such as a landing page, instructing them to run commands in the Windows Run dialog. This user interaction element helps bypass conventional security solutions. Various malware, including infostealers and remote access tools, are delivered through ClickFix attacks. The technique has evolved to target macOS users and is being sold as part of malware kits on hacker forums.
A modified version of the ACRStealer infostealer is being actively distributed, featuring enhanced detection evasion and analysis obstruction techniques. The malware uses the Heaven's Gate technique for executing x64 code in WoW64 processes and implements low-level NT functions for C2 communications. It employs domain disguising, self-signed certificates, and data encryption. Recent variants have introduced random string paths for exfiltration and changed the configuration request method. ACRStealer, now rebranded as AmateraStealer, can steal sensitive information from various sources and install additional malware. The ongoing feature updates make it one of the most active infostealer variants, posing a significant threat to users.
This analysis reveals the complex operations of Lumma affiliates within a vast information-stealing ecosystem. Affiliates utilize various tools and services, including proxy networks, VPNs, anti-detect browsers, and crypting services. The investigation uncovered previously undocumented tools and showed that affiliates often run multiple schemes simultaneously, such as rental scams, while also using other infostealers like Vidar, Stealc, and Meduza Stealer. Lumma affiliates are deeply integrated into the cybercriminal ecosystem, leveraging underground forums for resources, marketplaces, and operational support. The analysis highlights the resilience of Lumma's infrastructure and the challenges in disrupting such decentralized cybercriminal networks.
When Theft Replaces Encryption: Blue Report 2025 on Ransomware & Infostealers
Source: https://www.bleepingcomputer.com/news/security/when-theft-replaces-encryption-blue-report-2025-on-ransomware-and-infostealers/
A massive distribution of SmartLoader malware has been discovered through GitHub repositories masquerading as legitimate projects. These repositories focus on topics like game cheats, software cracks, and automation tools to attract users. The malware is distributed via compressed files containing a legitimate Lua loader executable, a malicious batch file, and an obfuscated Lua script. Once executed, SmartLoader establishes persistence, sends system information to a C2 server, and downloads additional payloads. The malware has been observed downloading InfoStealer malware such as Rhadamanthys, Redline, and Lumma Stealer. Users are advised to download software only from official sources and to carefully verify the credibility of GitHub repositories before use.
A VBS-based infostealer called Cmimai Stealer has emerged, targeting Windows systems since June 2025. It collects system information, browser metadata, and screenshots, exfiltrating data via Discord webhooks. The malware uses PowerShell scripts for browser data collection and screen capture, running in a persistent loop every hour. It leverages WMI for system information gathering and employs JSON formatting for data exfiltration. While lacking advanced features like encrypted communication or credential theft, Cmimai Stealer serves as both an infostealer and a reconnaissance tool. Defensive considerations include monitoring high-risk process combinations, watching for specific PowerShell scripts and image files, and detecting Discord traffic with a unique User-Agent.
Unit 42 researchers have identified a shift in the delivery method and obfuscation techniques used for distributing DarkCloud Stealer. The new infection chain, observed since April 2025, involves ConfuserEx obfuscation and a final payload written in Visual Basic 6. The attack begins with phishing emails containing compressed archives (TAR, RAR, or 7Z) that include JavaScript or Windows Script files. These files download and execute a PowerShell script, which then drops an executable protected by ConfuserEx. The final payload is a VB6 executable injected into a legitimate process using RunPE techniques. The malware employs various obfuscation methods, including anti-tampering, symbol renaming, and proxy call methods, to complicate analysis and evade detection.
SentinelLABS and Beazley Security uncovered a series of infostealer campaigns delivering the Python-based PXA Stealer. The malware, which first appeared in late 2024, has evolved to incorporate sophisticated anti-analysis techniques and a hardened command-and-control infrastructure. Over 4,000 unique victim IP addresses from 62 countries were identified, with South Korea, the United States, and the Netherlands being the most targeted. The stolen data includes passwords, credit card records, and browser cookies. The threat actors, linked to Vietnamese-speaking cybercriminal circles, monetize the stolen data through a subscription-based underground ecosystem that automates resale via Telegram's API. The campaign showcases the growing trend of weaponizing legitimate infrastructure for large-scale information theft and monetization.
A malicious campaign using the domain 'telegrampremium[.]app' is distributing a new variant of Lumma Stealer malware. The fake site mimics the official Telegram Premium platform and automatically downloads an executable file 'start.exe' upon access. This sophisticated information-stealing trojan can exfiltrate browser credentials, cryptocurrency wallet details, and system information. The malware employs various techniques for persistence, defense evasion, and data theft, including file system manipulation, registry modification, and clipboard operations. The campaign highlights the ongoing use of brand impersonation and social engineering for large-scale malware distribution, emphasizing the need for robust security measures and user awareness.
NOVABLIGHT is a NodeJS-based Malware-as-a-Service (MaaS) information stealer developed by a French-speaking threat group. It's sold as an educational tool but used for credential theft and cryptowallet compromise. The malware features heavy obfuscation, multiple anti-analysis techniques, and various data exfiltration methods. It can disable Windows Defender, sabotage system recovery, and inject malicious code into popular Electron-based applications. NOVABLIGHT employs comprehensive system enumeration, captures screenshots and webcam footage, and steals passwords from various sources. The threat actors use Telegram and Discord for sales and support, with licenses valid for up to a year.
Raven Stealer is a modern, lightweight information-stealing malware developed in Delphi and C++. It targets Chromium-based browsers to extract sensitive data, including passwords, cookies, and payment details. The malware uses a modular architecture and UPX packing to evade detection. It executes stealthily and exfiltrates data via Telegram bot integration. Distributed through GitHub and promoted on Telegram, Raven Stealer's user-friendly interface and dynamic module support make it attractive in the commodity malware ecosystem. The malware's capabilities include credential theft, browser data harvesting, and real-time exfiltration, posing a significant threat when used maliciously.
Hacker sneaks infostealer malware into early access Steam game
Source: https://www.bleepingcomputer.com/news/security/hacker-sneaks-infostealer-malware-into-early-access-steam-game/
Lumma infostealer malware returns after law enforcement disruption
Source: https://www.bleepingcomputer.com/news/security/lumma-infostealer-malware-returns-after-law-enforcement-disruption/
Katz Stealer is a sophisticated infostealer marketed as Malware-as-a-Service (MaaS), launched in early 2025. It features robust credential and data theft capabilities, along with modern evasion and anti-analysis techniques. The stealer targets a wide range of personal and sensitive information, including passwords, cryptocurrency keys, and browser session data. Operated through a web-based management panel, Katz Stealer allows affiliates to generate custom payloads and manage stolen data. Its infection chain involves obfuscated JavaScript droppers, steganography, and process hollowing techniques. The malware focuses heavily on browser data theft and cryptocurrency wallet targeting, with the ability to bypass some browser security measures.
A new variant of the Odyssey infostealer for macOS has been discovered, featuring code signing, notarization, and a persistent backdoor. The malware mimics a Google Meet updater and uses a SwiftUI-based 'Technician Panel' for social engineering. It steals sensitive data, including passwords, browser information, and cryptocurrency wallet contents. The stealer now includes a second-stage payload that establishes persistence and communicates with a command-and-control server. Notable features include dynamic command execution, network tunneling capabilities, and self-termination mechanisms. The malware also employs anti-analysis techniques to evade researchers. Multiple signed and notarized samples have been identified in the wild, indicating an evolution in the threat actor's tactics.
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine
Source: https://hackread.com/github-abused-amadey-lumma-redline-infostealers-ukraine/
This analysis provides insights into Infostealer malware trends observed in June 2025. The data, collected through various automated systems, reveals changes in distribution methods and malware types. While LummaC2 has been dominant, June saw increased activity from Rhadamanthys, ACRStealer, Vidar, and StealC. A new variant of ACRStealer emerged, using advanced techniques like HTTP host domain spoofing and anti-analysis methods. Distribution via crack disguises decreased, with 94.4% in EXE format and 5.6% using DLL-SideLoading. A unique malware type was observed, creating an uncontrollable window prompting browser updates. Some samples now hide compression passwords in image files, indicating evolving evasion tactics.
A sophisticated infostealer dubbed NordDragonScan has been discovered, targeting Windows systems through weaponized HTA scripts. The malware is distributed via shortened links leading to RAR archives containing malicious LNK shortcuts. Once installed, NordDragonScan performs extensive reconnaissance, collecting system information, network details, browser data, and sensitive documents. It utilizes custom obfuscation techniques and establishes persistence through registry modifications. The stolen data is exfiltrated to a command-and-control server using TLS encryption. The attack employs various decoy documents to evade detection and maximize infection opportunities. NordDragonScan's capabilities include screenshot capture, Chrome and Firefox profile harvesting, and local network scanning.
Leaked Shellter Elite Tool for Red Teams Now Enabling Infostealer Attacks Worldwide
Source: https://hackread.com/leaked-shellter-elite-tool-infostealer-attacks-worldwide/
