Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Blitz is a new Windows-based malware discovered in 2024 consisting of a downloader and bot payload. The latest version was spread through backdoored game cheats for Standoff 2 distributed via Telegram. Blitz abuses Hugging Face Spaces to host components of its C2 infrastructure and payloads. The malware performs information stealing and DDoS attacks. An XMRig cryptocurrency miner was also deployed as follow-up malware. By May 2025, the developer claimed to have abandoned the project. Russia accounted for the highest number of infections among 289 victims across 26 countries. Palo Alto Networks customers are protected through various security products and services.

Blitz is a Windows-based malware campaign identified in 2024, characterized by a modular architecture consisting primarily of a downloader and a bot payload. The malware's distribution vector is notably through backdoored game cheats for the popular mobile game Standoff 2, which were disseminated via Telegram channels. This method leverages the gaming community's trust and eagerness for cheats to propagate the malware. A distinctive feature of Blitz is its abuse of Hugging Face Spaces, a legitimate AI model hosting platform, to host components of its command and control (C2) infrastructure and payloads. This tactic complicates detection and takedown efforts because it blends malicious activity with legitimate cloud services.

Once deployed, Blitz performs multiple malicious activities: it steals sensitive information from infected systems and conducts distributed denial-of-service (DDoS) attacks, potentially disrupting network availability for targeted entities. Additionally, the malware deploys an XMRig cryptocurrency miner as a secondary payload, which hijacks system resources to mine Monero cryptocurrency, leading to degraded system performance and increased operational costs. By May 2025, the malware developer reportedly abandoned the project, but the infection footprint remains significant, with 289 victims identified across 26 countries. Russia has the highest infection count, indicating either targeting preferences or greater exposure.

The malware employs a wide range of tactics and techniques as mapped to MITRE ATT&CK, including credential dumping (T1003.001), input capture (T1056.001), command and control over web protocols (T1071), process injection (T1055), and persistence mechanisms (T1547.001), among others. These techniques enable stealthy operation, lateral movement, and sustained presence within compromised environments. Palo Alto Networks customers benefit from protection via their security products, but organizations outside this ecosystem may remain vulnerable.

Overall, Blitz represents a multifaceted threat combining social engineering (via game cheats), abuse of legitimate cloud infrastructure, and a blend of espionage and resource hijacking activities.

Detailed information about Blitz Malware: A Tale of Game Cheats and Code Repositories. Get real-time updates, technical details, and mitigation strategies.

Blitz Malware: A Tale of Game Cheats and Code Repositories - Live Threat Intelligence - Threat Radar | OffSeq.com

Blitz Malware: A Tale of Game Cheats and Code Repositories

Cybercriminals are exploiting the US tax season to deploy Stealerium malware, targeting citizens through sophisticated phishing campaigns. The attack utilizes deceptive email attachments with malicious LNK files, leading to the execution of PowerShell scripts and the download of a PyInstaller-packaged executable. This payload injects into mstsc.exe and deploys Stealerium, an information-stealing malware that exfiltrates sensitive data from browsers, cryptocurrency wallets, and popular applications. The malware employs anti-analysis techniques, creates a hidden directory, and registers with a command and control server. It steals credentials from various sources, including browsers, gaming platforms, and messaging apps, while also capturing webcam images and Wi-Fi passwords.

The Stealerium-infostealer campaign is a sophisticated malware threat exploiting the US tax season to target individuals primarily in the United States through phishing emails. The attack vector involves sending deceptive emails containing malicious LNK (Windows shortcut) files as attachments. When a victim opens the LNK file, it triggers the execution of a PowerShell script that downloads a PyInstaller-packaged executable payload. This payload performs process injection into mstsc.exe, the Microsoft Terminal Services Client process, a legitimate Windows process, to evade detection and maintain persistence on the infected system. The injected malware, Stealerium, is an information stealer designed to exfiltrate a broad range of sensitive data, including credentials stored in web browsers, cryptocurrency wallets, gaming platforms, messaging applications, Wi-Fi passwords, and even webcam images. Stealerium employs anti-analysis techniques to hinder forensic investigation and detection, creates hidden directories to conceal its components, and communicates with a command and control (C2) server to receive instructions and exfiltrate stolen data. The campaign leverages social engineering tactics tied to the US tax season to increase the likelihood of user interaction and infection. Although no specific software versions are listed as affected, the infection relies heavily on user interaction with phishing emails and execution of malicious attachments. There are no known public exploits or patches currently available. Indicators of compromise include multiple file hashes associated with the malware components. The campaign’s use of process injection and anti-analysis techniques complicates detection and remediation efforts, increasing the potential dwell time and damage caused by the malware.

Detailed information about Threat Actors are Targeting US Tax-Session with new Tactics of Stealerium-infostealer. Get real-time updates, technical details, and 

Title	Severity	Type	Source	Date

Threats Tagged 'information stealing'

Filter Threats

Threats Tagged 'information stealing'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility