Tag: credential-stealer

6 Attack Reports | 0 Vulnerabilities

Attack reports

OCTALYN STEALER UNMASKED

The Octalyn Forensic Toolkit, a publicly available GitHub project, presents itself as a research tool but functions as a sophisticated credential stealer. It consists of a C++ payload module and a Delphi-based builder interface, allowing even low-skilled actors to generate functional binaries. The …

credential stealer

octalyn stealer

telegram exfiltration

Published: July 16, 2025

Downloadable IOCs: 7

Snake Keylogger in Geopolitical Affairs: Abuse of Trusted Java Utilities in Cybercrime Operations

The S2 Group’s intelligence team has identified through adversary tracking a new phishing campaign by Snake Keylogger, a Russian origin stealer programmed in .NET, targeting various types of victims, such as companies, governments or individuals. The campaign has been identified as using spearphish…

malware-as-a-service

snake keylogger

credential stealer

Published: June 30, 2025

Downloadable IOCs: 34

Masslogger Fileless Variant – Spreads via .VBE, Hides in Registry

A sophisticated variant of the Masslogger credential stealer malware has been identified spreading through .VBE files. This multi-stage fileless malware heavily relies on Windows Registry to store and execute its malicious payload. The infection begins with a .VBE file, likely distributed via spam …

windows registry

data exfiltration

process hollowing

credential stealer

fileless malware

Published: June 18, 2025

Downloadable IOCs: 1

Katz Stealer Threat Analysis

Katz Stealer is a sophisticated credential-stealing malware-as-a-service that targets multiple browsers, cryptocurrency wallets, and communication platforms. It employs advanced evasion techniques like geofencing, VM detection, and process hollowing. The infection chain involves obfuscated JavaScri…

process-hollowing

credential-stealer

browser-targeting

discord-hijacking

evasion-techniques

Published: May 26, 2025

Downloadable IOCs: 34

Interlock ransomware evolving under the radar

The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdo…

double extortion

remote access trojan

credential stealer

interlock ransomware

powershell backdoor

Published: April 16, 2025

Downloadable IOCs: 0

Unwrapping the emerging Interlock ransomware attack

A new ransomware group called Interlock has emerged, targeting various sectors with big-game hunting and double extortion attacks. The group uses a sophisticated delivery chain including a RAT disguised as a browser updater, PowerShell scripts, credential stealers, and keyloggers. They primarily mo…

double-extortion

credential-stealer

Published: November 7, 2024

Downloadable IOCs: 2

Click here to see more Attack Reports