Loading malware…
Marco Stealer is a Windows-oriented information stealer first observed in June 2025. It is delivered via a downloader in a ZIP archive and is designed for financial theft by harvesting sensitive data from browsers, cryptocurrency wallet/browser-extension data, and local files. It also searches for sensitive files in cloud-synced folders associated with services such as Dropbox and Google Drive, making it a threat to both individual and corporate environments.
Reported capabilities include collection of browser data, cryptocurrency wallet information, and files from the victim system; system profiling of infected hosts including OS version, hardware ID, IP address, and geolocation; runtime decryption of encrypted strings to hinder static analysis; and anti-analysis behavior that scans for and attempts to terminate tools such as Wireshark, x64dbg, and Process Hacker. Stolen data is encrypted with AES-256-CBC prior to exfiltration, with reporting stating the malware derives the encryption key by hashing a hardcoded value. Exfiltration is performed via HTTP POST to command-and-control infrastructure and includes an encrypted bundle containing items such as a victim client ID, hardware ID, and stolen files.
High-confidence targeting described in the reporting includes browser-stored data, cryptocurrency extensions/wallets, and sensitive local or cloud-synced documents. The malware has been reported by Zscaler ThreatLabz, which characterized it as a sophisticated new stealer targeting victims worldwide.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a comparison family that did not technically match the observed sample.
Windows information stealer (first observed June 2025) delivered via a ZIP downloader; steals browser data, crypto wallet info, and files from cloud services (e.g., Dropbox/Google Drive), uses runtime string decryption and anti-analysis checks, and encrypts stolen data with AES-256 before HTTP POST exfiltration.
Windows information stealer delivered via a ZIP downloader; targets browser data, crypto wallet info, and files from cloud services (e.g., Dropbox, Google Drive); uses runtime string decryption, anti-analysis checks, and AES-256 encryption for exfiltrated data.
Information-stealing malware focused on harvesting browser data, cryptocurrency wallet data from browser extensions (to enable theft of private keys/funds), and sensitive files from local storage and synced cloud folders (notably Dropbox and Google Drive). Performs host profiling (OS version, hardware ID, IP, geolocation), uses anti-analysis (runtime string decryption; attempts to terminate tools like Wireshark, x64dbg, Process Hacker), and exfiltrates data to C2 over HTTP with AES-256-CBC encryption.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.