Loading malware…
Meduza Stealer is a Windows information-stealing malware family that emerged in 2023 and is marketed in the cybercrime ecosystem as a commercial stealer. It is used to harvest credentials and other sensitive data from infected systems and has been observed in criminal operations alongside other commodity malware and ransomware tooling. Meduza has been discussed and traded on underground forums, and reporting indicates it has been adopted by financially motivated threat actors including operators associated with Black Basta and access-broker activity linked to TA569 follow-on infections. Russian authorities have also reportedly detained individuals accused of developing and distributing the malware.
The malware is associated with credential theft from Windows systems, including abuse of Windows Credential Vault access through VaultCLI-related functionality. Reporting also indicates Meduza has successfully bypassed Chrome App-Bound Encryption protections, placing it among a set of modern stealers capable of extracting protected browser data despite recent defensive hardening. Its core role is theft of credentials and other victim information for resale, account takeover, or downstream intrusion activity.
Meduza has been delivered through multiple malware distribution chains rather than a single exclusive vector. Observed delivery includes installation by BunnyLoader and attempted deployment through NetSupport RAT activity in phishing-driven campaigns. It has therefore appeared as a secondary payload in broader intrusion ecosystems that rely on social engineering, loaders, and remote access tooling to establish initial footholds before deploying stealers.
Infrastructure and ecosystem reporting links Meduza to abuse-resistant hosting services used by cybercriminal operators. Aeza Group was publicly tied to infrastructure supporting Meduza operations, alongside other infostealers and ransomware-related services. Meduza has also been referenced in threat-hunting and infrastructure-discovery work focused on criminal panels and command-and-control exposure.
Meduza is best characterized as a commodity infostealer used in financially motivated cybercrime. Its significance lies less in destructive capability than in efficient collection of credentials and browser-resident secrets, its integration into loader and phishing ecosystems, and its adoption by established criminal actors seeking scalable access, fraud enablement, and post-compromise monetization.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The VaultCLI.dll module allows processes to extract credentials from the Windows Credential Vault. It was seen being abused by information stealers such as Meduza.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Collection Atomic, Vidar, Meduza, Raccoon, Snaffler, Hekatomb, Lumma, DBeaver, MongoDB Compass, Azure SQL Query Editor, Cerebrata, FiveTran, Ave-Maria
In a number of cases, we observed attempts to use NetSupport RAT to install stealers such as Rhadamanthys and Meduza.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Russian police arrested “three young IT specialists” suspected of developing and selling the Meduza credential-harvesting malware.
Browser data: Credentials, cookies, histories, bookmarks, autofill data, and more, with support for more than 100 browsers
According to researchers at Hudson Rock, Meduza was highly equipped with tools to scoop up a wealth of data, including: Authentication: Targeted popular password managers and 2FA extensions
Authentication: Targeted popular password managers and 2FA extensions
Identifying command-and-control (C2) infrastructure , open directories , and phishing assets is a key part of modern threat hunting.
153 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information stealer cited as using Aeza Group hosting infrastructure.
Infostealer malware whose operators were supported by Aeza Group hosting infrastructure, according to the content.
Referenced as a known stealer whose theft target list is similar to the malware under analysis. No direct operational details beyond similarity are provided in the content.
A named infostealer listed in the RAMP malware marketplace.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.