Malware

MicroStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The malware spreads through fake software installers, malicious downloads hosted on platforms like Dropbox and SourceForge, and phishing lures disguised as game launchers or software updates.

Execution

1 technique

T1204User ExecutionEvidence1

It does not rely on vulnerability exploitation to get into a system. Instead, it counts on the user trusting a file enough to run it, making social engineering its primary entry point.

Privilege Escalation

1 technique

T1548Abuse Elevation Control MechanismEvidence1

This Electron app, disguised as a “Game Launcher,” presents a UAC prompt requesting administrator privileges. Once the user grants access, the application extracts a bundled Java Runtime Environment and a JAR payload...

Stealth

2 techniques

T1036MasqueradingEvidence1

This Electron app, disguised as a “Game Launcher,” presents a UAC prompt requesting administrator privileges... the Java executable is renamed “miicrosoft.exe,” a deliberate misspelling designed to mimic a legitimate Windows process name.

T1497Virtualization/Sandbox EvasionEvidence1

Before it begins, it checks the environment for signs of a virtual machine. If it detects analysis tools or sandbox processes, it stops immediately.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

Once inside a system, MicroStealer steals active browser sessions for SaaS platforms, VPNs, cloud services, and corporate portals.

T1555Credentials from Password StoresEvidence1

It goes after browser credentials, session cookies, desktop screenshots, cryptocurrency wallet files, and account data from platforms like Discord and Steam.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

Before it begins, it checks the environment for signs of a virtual machine. If it detects analysis tools or sandbox processes, it stops immediately.

Collection

1 technique

T1113Screen CaptureEvidence1

If the environment appears to be a real user machine, it harvests credentials, cookies, session tokens, screenshots, and wallet files...

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

...then exfiltrates everything through two simultaneous channels: a Discord webhook and an attacker-controlled server.

T1567Exfiltration Over Web ServiceEvidence1

...then exfiltrates everything through two simultaneous channels: a Discord webhook and an attacker-controlled server.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

May 4, 2026

New MicroStealer Malware Actively Attacking Telecom & Education Sectors

MicroStealer is an infostealer that targets browser credentials, session cookies, screenshots, cryptocurrency wallet files, and account data from platforms such as Discord and Steam. It spreads via fake software installers, malicious downloads, and phishing lures, uses a multi-stage NSIS/Electron/Node.js/Java execution chain, performs VM/sandbox checks, and exfiltrates stolen data through both a Discord webhook and an attacker-controlled server.

risky biz rssNews

Mar 13, 2026

Another residential proxy provider falls as authorities continue crackdowns

A newly documented infostealer malware strain.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MicroStealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The malware spreads through fake software installers, malicious downloads hosted on platforms like Dropbox and SourceForge, and phishing lures disguised as game launchers or software updates.

Execution

1 technique

T1204User ExecutionEvidence1

It does not rely on vulnerability exploitation to get into a system. Instead, it counts on the user trusting a file enough to run it, making social engineering its primary entry point.

Privilege Escalation

1 technique

T1548Abuse Elevation Control MechanismEvidence1

Stealth

2 techniques

T1036MasqueradingEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

Before it begins, it checks the environment for signs of a virtual machine. If it detects analysis tools or sandbox processes, it stops immediately.

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

Once inside a system, MicroStealer steals active browser sessions for SaaS platforms, VPNs, cloud services, and corporate portals.

T1555Credentials from Password StoresEvidence1

It goes after browser credentials, session cookies, desktop screenshots, cryptocurrency wallet files, and account data from platforms like Discord and Steam.

Discovery

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

Before it begins, it checks the environment for signs of a virtual machine. If it detects analysis tools or sandbox processes, it stops immediately.

Collection

1 technique

T1113Screen CaptureEvidence1

If the environment appears to be a real user machine, it harvests credentials, cookies, session tokens, screenshots, and wallet files...

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

...then exfiltrates everything through two simultaneous channels: a Discord webhook and an attacker-controlled server.

T1567Exfiltration Over Web ServiceEvidence1

...then exfiltrates everything through two simultaneous channels: a Discord webhook and an attacker-controlled server.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

May 4, 2026

New MicroStealer Malware Actively Attacking Telecom & Education Sectors

risky biz rssNews

Mar 13, 2026

Another residential proxy provider falls as authorities continue crackdowns

A newly documented infostealer malware strain.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.