Loading story…
A refreshed CryptBot campaign has been distributing a Windows infostealer through websites posing as sources for cracked software, key generators, and free game or professional software downloads. The malware steals browser credentials, cookies, browsing history, cryptocurrency wallet data, credit card information, and files from infected systems, while operators use SEO poisoning and rapidly rotated lure sites and command-and-control infrastructure to drive victims to malicious downloads. Reporting indicates the malware was heavily associated with users seeking pirated software, and telemetry in one analyzed campaign suggested Russia was a primary target.
Technical analysis of a newer CryptBot downloader shows a 32-bit statically linked sample using libcurl 8.10.1 and OpenSSL 3.3.2, with evolving obfuscation that includes modified plaintext C2 URLs and control-flow tricks in the main routine. The downloader fetched an encrypted second-stage DLL over unencrypted HTTP from .top domains, then decrypted it with AES-CBC using a PBKDF2-SHA1-derived key built from the server-provided filename, the URL, and a static key suffix embedded in the sample. Researchers also noted the malware had been streamlined by removing some older anti-analysis and collection features while improving Chrome data theft so it could extract information across all Chrome versions rather than a limited version range.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
TEHTRIS disclosed technical details on a CryptBot downloader variant, including its HTTP-based stage-two retrieval, AES-CBC/PBKDF2 decryption scheme, C2 infrastructure, hashes, and YARA and Snort detection content. The report also noted that identified C2 servers had been frequently shut down and were unavailable at the time of writing.
Google released Chrome 96, a milestone that later exposed a limitation in older CryptBot versions that relied on fixed Chrome user-data paths.
TEHTRIS analyzed a recent CryptBot downloader campaign that lasted about one month based on PE compilation timestamps, with activity peaking roughly one week after it began. Russia appeared to be the primary targeted country based on VirusTotal first-submission data.
Ahn Lab reported a new CryptBot variant being spread through fake crack, keygen, and free-download sites promoted with SEO poisoning. The updated malware removed several older functions while improving Chrome data theft by searching all paths for Chrome user data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google filed a civil action in the U.S. District Court for the Southern District of New York against alleged CryptBot distributors, accusing named defendants and unidentified operators of running a malware distribution enterprise built around the `360installer` pay-per-install network and OffShoric hosting. The company said the group spread CryptBot through cracked-software and fake download sites, including trojanized versions of **Google Chrome** and **Google Earth Pro**, and that a federal judge unsealed the case and granted a temporary restraining order to support disruption of current and future distribution domains. Google alleged roughly **670,000 infections** over the prior year from the identified sites alone and said the operation harmed Chrome users by stealing credentials, browser cookies, credit card data, social media logins, cryptocurrency wallet information, screenshots, and Chrome extension data for later sale and abuse. Security research cited across multiple reports shows CryptBot has been a fast-moving infostealer operation for years, repeatedly changing its packing, filenames, scripts, code paths, and command-and-control infrastructure to evade detection while relying heavily on fake cracks, serials, and software installers surfaced in search results. Analysts documented multi-stage delivery using archives, BAT scripts, AutoIt components, and in some campaigns public services such as Bitbucket, where one malicious repository was observed serving malware at volumes suggesting about **40,000 downloads per day** before takedown. Recent samples used recurring `.top` infrastructure and improved browser-theft logic for newer Chrome versions, while also downloading follow-on payloads such as ClipBanker, underscoring that CryptBot functioned not only as a credential thief but as part of a broader malware distribution ecosystem.
Aug 15, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026