MalwareUsed by 5 actors

OmniStealer

OmniStealer is a Python-based information stealer targeting Windows, macOS, and Linux. It harvests browser credentials, cookies, cryptocurrency wallet data and private keys, password-manager data, cloud-storage credentials, developer secrets, and source code. Its targets include Chromium-based browsers and Firefox, cryptocurrency wallet browser extensions and standalone applications, and password-manager extensions and applications. It also collects Git credentials and GitHub CLI tokens. Stolen data can be exfiltrated over HTTP, with Telegram Bot API uploads as a fallback.

OmniStealer is deployed in North Korea-linked developer-targeting operations, including the Cross-Chain TxDataHiding campaign and PolinRider supply-chain activity associated with Contagious Interview and Famous Chollima. Infection chains use fake recruitment opportunities and coding assignments, weaponized GitHub repositories, and compromised software packages. Obfuscated JavaScript loaders retrieve encrypted follow-on stages through TRON, Aptos, and BNB Smart Chain transaction data before deploying the stealer. Supporting downloaders can provision Python on Windows when needed.

The malware frequently accompanies the DEV#POPPER remote-access trojan, but serves as a separate, one-time data-harvesting payload. These operations primarily target software developers and cryptocurrency-sector personnel, seeking credentials, development assets, and material enabling access to cryptocurrency wallets.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Contagious Interview

OmniStealer is a 3,500-line Python credential harvester targeting browsers, crypto wallets, password managers, and cloud storage across Windows, macOS, and Linux.

via ransom isac blogransom-isac.org

APT37

“Access to lsass is observed, and a second YARA rule fires for an XFiles and OmniStealer style information stealer.”

via malbeacon blogblog.deception.pro

Lazarus

“Access to lsass is observed, and a second YARA rule fires for an XFiles and OmniStealer style information stealer.”

via malbeacon blogblog.deception.pro

DPRK

the first Python Downloader ( Payload1_2 (HTTP Payload Stager) ) which ultimately leads to downloading the OmniStealer malware as discussed in Part 2

via ransom isac blogransom-isac.org

PolinRider

The decrypted payloads then deploy remote access malware, including DEV#POPPER RAT and OmniStealer, to exfiltrate data from the compromised systems.

via cysecurity newscysecurity.news

MITRE ATT&CK

Techniques & procedures

27 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

6 techniques

T1078Valid AccountsEvidence1

temp_auto_push.bat , the script behind the GitHub and Go compromises, runs locally on the infected machine using the developer's own already-authorized git credentials.

T1195Supply Chain CompromiseEvidence5

“Victim receives a fake job offer via Telegram, pointing to a GitHub repo or trojanized NPM package.”

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

DPRK’s goal is to compromise developer machines and accounts to silently propagate malicious code, clone repositories, and push backdoored commits without active human intervention.

T1195.002Compromise Software Supply ChainEvidence1

T1195.002 — Compromise Software Supply Chain (Initial Access)

T1566.002Spearphishing LinkEvidence1

“Victim receives a fake job offer via Telegram, pointing to a GitHub repo or trojanized NPM package.”

T1566.003Spearphishing via ServiceEvidence1

PolinRider has spent at least five months getting into thousands of developer machines any way it can: fake interviews, poisoned forks, malicious VS Code tasks, typosquatted packages.

Execution

3 techniques

T1059.006PythonEvidence5

“[The HTTP stager] acted as a Python dropper: it installed Python silently on the victim's machine, then used it to fetch ... the OmniStealer payload.”

T1059.007JavaScriptEvidence1

the payload dropped into each module is DPRK's obfuscated JavaScript loader. It resolves a second-stage payload from blockchain RPC infrastructure ... decrypts it with an embedded XOR key, and executes it with eval()

T1127.001MSBuildEvidence1

A committed .vscode/tasks.json with runOptions.runOn: 'folderOpen' executes the moment the project folder opens in VS Code, Cursor, Antigravity, or GitHub Desktop, bypassing npm v12's lifecycle-script protections entirely.

Persistence

2 techniques

T1078Valid AccountsEvidence1

temp_auto_push.bat , the script behind the GitHub and Go compromises, runs locally on the infected machine using the developer's own already-authorized git credentials.

T1556Modify Authentication ProcessEvidence1

In each case, a malicious version was published under the package owner’s identity but without their consent.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

temp_auto_push.bat , the script behind the GitHub and Go compromises, runs locally on the infected machine using the developer's own already-authorized git credentials.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence2

“The initial loader checks transactions on TRON ... to locate encrypted JavaScript stored in BNB Smart Chain transactions.”

T1036MasqueradingEvidence1

public/fonts/fa-solid-400.woff2 isn't a font. It's JavaScript that reads XOR-encrypted payloads from on-chain transactions

T1078Valid AccountsEvidence1

temp_auto_push.bat , the script behind the GitHub and Go compromises, runs locally on the infected machine using the developer's own already-authorized git credentials.

T1127.001MSBuildEvidence1

T1564.003Hidden WindowEvidence1

decrypts it with an embedded XOR key, and executes it with eval() for remote code execution and persistence through detached background processes.

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

In each case, a malicious version was published under the package owner’s identity but without their consent.

Credential Access

6 techniques

T1003OS Credential DumpingEvidence1

“Access to lsass is observed, and a second YARA rule fires for an XFiles and OmniStealer style information stealer.”

T1056.001KeyloggingEvidence1

The follow-on payloads are the familiar Lazarus toolkit: DEV#POPPER, OmniStealer, and InvisibleFerret, covering credential theft, browser-data theft, crypto-wallet exfiltration, and keylogging.

T1539Steal Web Session CookieEvidence2

covering credential theft, browser-data theft, crypto-wallet exfiltration, and keylogging.

T1555Credentials from Password StoresEvidence4

“A separate one-time stealer seeks browser information, password manager data, cloud storage credentials and cryptocurrency wallet material.”

T1556Modify Authentication ProcessEvidence1

In each case, a malicious version was published under the package owner’s identity but without their consent.

T1649Steal or Forge Authentication CertificatesEvidence1

Once the malware has harvested a maintainer's ~/.npmrc token, it either publishes directly, or it simply waits and lets the maintainer's own next npm publish carry the payload along.

Collection

3 techniques

T1056.001KeyloggingEvidence1

The follow-on payloads are the familiar Lazarus toolkit: DEV#POPPER, OmniStealer, and InvisibleFerret, covering credential theft, browser-data theft, crypto-wallet exfiltration, and keylogging.

T1113Screen CaptureEvidence1

“pip installs requests, pyperclip, mss, and Pillow, the toolkit for clipboard theft, screen capture, and HTTP exfiltration.”

T1115Clipboard DataEvidence1

“pip installs … pyperclip … the toolkit for clipboard theft” and “ClipboardMonitor.”

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

novel tradecraft such as Cross-Chain TxDataHiding techniques combined with the subsequent creation of a takedown-proof Command and control (C2) infrastructure

T1071Application Layer ProtocolEvidence1

a multi-layered attack leveraging novel blockchain-based command-and-control infrastructure

T1071.001Web ProtocolsEvidence3

“C2 path /init Port 443 endpoint returning the RAT and scanner” and “C2 path /boot Port 443 Ethereum recovery endpoint.”

T1102Web ServiceEvidence1

“The malware queries a TRON wallet ... with Aptos as a fallback,” retrieves encrypted JavaScript from BSC transaction calldata, and “_Z scans Ethereum mainnet” through public RPC services.

T1105Ingress Tool TransferEvidence6

“The server then supplies code that can rebuild the infection.”

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence3

“The stealer begins POSTing host data to 150.251.113[.]223:8443” and the indicator labels the host “Stealer exfil.”

T1567Exfiltration Over Web ServiceEvidence2

“Researchers counted 153 wallet targets and said stolen data leaves through a messaging bot interface.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

57 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

15 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

32 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

10 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app11 days ago

hash.sha1●●●●●●●●●●●●View more in app11 days ago

ip.v4●●●●●●●●●●●●View more in app11 days ago

ACTIVITY FEED

Recent activity

25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

25 SOURCESView more in app

cyber security newsNews

Oct 8, 2026

Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials

Named as a follow-on payload delivered by the PolinRider campaign. The campaign's loaders use public blockchain infrastructure to obtain encrypted follow-on payloads and conceal malicious code in configuration files, fake font files, and editor task settings. OmniStealer's specific capabilities are not detailed.

cyber security newsNews

Sep 29, 2026

Hackers Turned Ethereum Into a Secret Messaging System for Malware

Credential and cryptocurrency-wallet stealer delivered within the XCTDH infection chain. It targets browser data, password-manager data, cloud credentials, and material from 153 cryptocurrency wallets; stolen data is exfiltrated through a messaging-bot interface.

lazarusholic blueskyNews

Sep 26, 2026

Post by @lazarusholic.bsky.social - Bluesky

Post links to "XCTDH Adopts Hash Hiding" and includes the hashtag #OmniStealer.

ransom isac blogNews

Sep 25, 2026

XCTDH Adopts Hash Hiding | Ransom-ISAC Blog - Ransom-ISAC

Python-based, one-shot credential harvester. It targets more than 60 wallet extensions, browser data, password managers, and cloud-storage data; the campaign's dropper silently installs Python to execute it, and it exfiltrates collected data through Telegram.

+21 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching57

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution5

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping27

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

OmniStealer