Malware

Creal Stealer

Creal Stealer is an open-source Python-based infostealer that has been actively abused by threat actors in credential-theft campaigns, including phishing operations themed around cryptocurrency services. It has commonly been distributed in malicious archive files and packaged into Windows executables with PyInstaller. Public availability of its source code and builder has lowered the barrier to entry for criminal use and likely contributed to the number of observed variants and campaigns.

The malware is designed to collect credentials, cookies, and other sensitive data from Chromium-based browsers, chat applications, gaming platforms, cold cryptocurrency wallets, and browser extensions. Reported targets include browser sessions and account data associated with financial, social media, streaming, gaming, messaging, and cryptocurrency services. It can also steal wallet-related information and session material useful for account takeover and fraud.

Creal Stealer includes anti-analysis logic that checks the infected host against hardcoded blacklists of usernames, hostnames, MAC addresses, and public IP addresses, and it terminates when matches are found. It also attempts to install missing Python dependencies through subprocess execution, reflecting its Python implementation and modular abuse of common libraries.

For persistence, Creal Stealer copies itself into the Windows Startup folder so it will execute when the user logs in. During collection, it writes stolen data to temporary files, renames or repackages the output, compresses the results, and then exfiltrates them to attacker-controlled services. Exfiltration has been observed through Discord webhooks as well as file-sharing platforms such as Anonfiles and Gofile.

Creal Stealer has also been linked to broader session-theft activity in which stolen browser cookies are used to hijack online accounts, including high-profile social media and video-platform channels later repurposed for cryptocurrency scams. Similarities in blacklist logic and other implementation details have been noted between Creal Stealer and other open-source stealers such as Luna Grabber, Kyoku Cookie Token Stealer, and BlackCap Grabber.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Cyble Research and Intelligence Labs (CRIL) discovered a phishing site mimicking a Cryptocurrency mining platform that was spreading Creal Stealer.

Execution

2 techniques

T1059.006PythonEvidence1

The file was found to be packaged with PyInstaller... The Strings data suggests that Python 3.11 was used to write this code sample.

T1204User ExecutionEvidence1

MITRE ATT&CK® Techniques ... Execution T1204 User Execution

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The stealer achieves persistence by copying itself to AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ directory using the shutil.copyfileobj() function.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The stealer achieves persistence by copying itself to AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ directory using the shutil.copyfileobj() function.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence1

Further analysis of mPSCzi.pyc_Source_Patcher.py reveals numerous junk functions. These functions have randomly generated names, perform calculations internally, and then are immediately invoked. These garbage functions are designed to obfuscate the analysis process.

T1140Deobfuscate/Decode Files or InformationEvidence1

At the very beginning of the mPSCzi.pyc_Source_Patcher.py file, a base64-encoded string is decoded... The resulting code snippet is used to decrypt the second stage of the data... After running the script, I obtained the following dumped_stage2.py.

Credential Access

3 techniques

T1528Steal Application Access TokenEvidence1

MITRE ATT&CK® Techniques ... Credential Access ... T1528 Steal Application Access Token

T1539Steal Web Session CookieEvidence1

According to reports, the TAs gained access to the YouTube account by stealing session cookies.

T1555Credentials from Password StoresEvidence1

Now, the stealer retrieves login credentials and cookies from the browsers based on the list of names mentioned in the table below.

Discovery

6 techniques

T1007System Service DiscoveryEvidence1

MITRE ATT&CK® Techniques ... Discovery ... T1007 System Service Discovery

T1057Process DiscoveryEvidence1

MITRE ATT&CK® Techniques ... Discovery ... T1057 Process Discovery

T1087Account DiscoveryEvidence1

During the initial execution, the stealer identifies whether it is being run in a controlled environment. It checks if the victim’s username ... is present in a list called ‘blacklistUsers’.

T1124System Time DiscoveryEvidence1

MITRE ATT&CK® Techniques ... Discovery ... T1124 System Time Discovery

T1518Software DiscoveryEvidence1

Now, the stealer checks if certain Python modules are installed, and if they are not, it attempts to install them using pip.

T1614System Location DiscoveryEvidence1

Creal stealer makes a GET request to hxxps[:]//api.ipify.org/ to identify the victim’s IP. Now it appends the IP address to hxxps[:]//geolocation-db.com/jsonp/ and makes a GET request to fetch the victim’s geolocation details.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Finally, Creal Stealer makes a POST request using the urlopen() function to exfiltrate data using a Discord webhook.

T1102Web ServiceEvidence1

Creal Stealer is capable of exfiltrating data using Discord Webhooks and multiple file-hosting & sharing platforms such as Anonfiles and Gofile.

T1105Ingress Tool TransferEvidence1

By searching with the “requests” library, we can find out the exact URL where the data will be posted.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

Finally, Creal Stealer makes a POST request using the urlopen() function to exfiltrate data using a Discord webhook.

T1567Exfiltration Over Web ServiceEvidence1

By searching with the “requests” library, we can find out the exact URL where the data will be posted.

INDICATORS OF COMPROMISE

IOCs tracked for this family

216 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

65 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

145 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

trellix blogNews

May 19, 2026

Skuld: The Infostealer that Speaks Golang

An open-source stealer project cited as a source of similar anti-analysis and Gofile exfiltration techniques used by Skuld.

zscaler threat labzNews

Jan 1, 2026

Bandit Stealer | ThreatLabz

Mentioned as another open-source stealer with similar blacklist information to Bandit.

kienmanowar blogNews

Aug 10, 2024

[QuickNote] Retrieve unknown python stealer from PyInstaller | 0day in {REA_TEAM}

A Python-based multi-stage stealer analyzed from a PyInstaller-packed executable. The sample uses heavy obfuscation, layered Base64/AES/XOR decryption, and ultimately decodes and executes a final Python stage that posts stolen data to a decoded remote domain.

trendmicro comNews

May 26, 2023

New Info Stealer Bandit Stealer Targets Browsers, Wallets | Trend Micro (UK)

Mentioned as another information stealer that used similar blacklist-based sandbox evasion content.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching216

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Creal Stealer