Cybersecurity articles tagged #Infostealer on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/infostealers-target-anthropic-claude-users-via-session-thefthttps://runtimerebel.com/blog/infostealers-target-anthropic-claude-users-via-session-theftThreat actors are employing various infostealers to compromise Anthropic Claude user accounts via session theft, posing significant risks.Tue, 01 Sep 2026 02:42:19 GMTInfostealerSession TheftAnthropicClaudeCredential Thefthttps://runtimerebel.com/blog/wordlistloader-evades-detection-delivers-amatera-infostealerhttps://runtimerebel.com/blog/wordlistloader-evades-detection-delivers-amatera-infostealerWordlistLoader uses a novel text-based obfuscation to bypass security, deploying the Amatera infostealer in ClickFix-style campaigns, posing a significant threat.Tue, 25 Aug 2026 08:33:21 GMTInfostealerMalwareObfuscationClickFixWordlistLoaderhttps://runtimerebel.com/blog/critical-rust-arrayref-crate-poisoned-with-infostealer-malwarehttps://runtimerebel.com/blog/critical-rust-arrayref-crate-poisoned-with-infostealer-malwareHackers compromised `arrayref`, `append-only-vec`, and `internment` Rust crates to inject infostealer malware, impacting developers and downstream projects.Fri, 21 Aug 2026 00:43:46 GMTRustSupply Chain AttackInfostealerDPRKCrates Iohttps://runtimerebel.com/blog/amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-controlhttps://runtimerebel.com/blog/amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-controlAmnesiaStealer targets macOS users via ClickFix attacks, cloning Chromium profiles to enable live remote control of authenticated browser sessions.Sun, 16 Aug 2026 16:14:35 GMTmacOSInfostealerClickFixChromiumAmnesiaStealerhttps://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealerhttps://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealerCritical npm supply chain attack involving nearly 800 malicious packages delivers WEL1DROPPER RAT and infostealer to Windows, macOS, and Linux users.Sat, 08 Aug 2026 00:54:29 GMTNPMSupply Chain AttackInfostealerRATWEL1DROPPERhttps://runtimerebel.com/blog/clickfix-attack-deploys-macos-infostealer-for-crypto-thefthttps://runtimerebel.com/blog/clickfix-attack-deploys-macos-infostealer-for-crypto-theftThe ClickFix attack leverages a Go-based macOS infostealer to pilfer cryptocurrency, browser data, and Apple Keychain credentials via a Bash script loader.Fri, 07 Aug 2026 02:08:44 GMTClickFixmacOSInfostealerCryptocurrencyGolanghttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialshttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialsMassive ChainDrop npm supply chain attack compromises over 1,300 packages, stealing developer and cloud credentials through malicious preinstall scripts.Tue, 04 Aug 2026 17:30:58 GMTNPMSupply Chain AttackInfostealerJavaScriptChainDrophttps://runtimerebel.com/blog/flying-eagle-mobile-rat-builder-china-s-infostealer-as-a-servicehttps://runtimerebel.com/blog/flying-eagle-mobile-rat-builder-china-s-infostealer-as-a-serviceAnalysis of the 'Flying Eagle' mobile RAT builder, a sophisticated malware-as-a-service platform from China, used by threat groups to deploy infostealers targeting…Thu, 30 Jul 2026 02:32:07 GMTFlying EagleMobile RATAndroid MalwareInfostealerMalware as a ServiceFinancial FraudChinahttps://runtimerebel.com/blog/javascript-smuggling-in-memory-malware-assembly-evades-defenseshttps://runtimerebel.com/blog/javascript-smuggling-in-memory-malware-assembly-evades-defensesAttackers use JavaScript Smuggling and Blob objects to assemble infostealer malware in-memory, bypassing security filters on fake crypto and trading sites.Sat, 25 Jul 2026 16:59:37 GMTJavascript SmugglingInfostealerBrowser SecurityVidarStealChttps://runtimerebel.com/blog/ai-assisted-phishing-leverages-webdav-for-infostealer-deploymenthttps://runtimerebel.com/blog/ai-assisted-phishing-leverages-webdav-for-infostealer-deploymentAn exposed server revealed an AI-assisted phishing toolkit used in a WebDAV-based infostealer campaign targeting Windows users in Mexico. Learn detection and mitigation.Mon, 20 Jul 2026 18:05:04 GMTAI Assisted PhishingWebDAVInfostealerMalware ToolkitMexicoWindowsRapid7https://runtimerebel.com/blog/acr-stealer-campaign-targets-microsoft-enterprise-credentialshttps://runtimerebel.com/blog/acr-stealer-campaign-targets-microsoft-enterprise-credentialsMicrosoft warns of a surge in ACR Stealer attacks targeting browser credentials and session tokens to bypass multi-factor authentication in enterprise environments.Sat, 18 Jul 2026 16:59:16 GMTACR StealerInfostealerMicrosoftCredential Thefthttps://runtimerebel.com/blog/north-korean-actors-use-svg-steganography-to-deliver-ottercookiehttps://runtimerebel.com/blog/north-korean-actors-use-svg-steganography-to-deliver-ottercookieNorth Korean threat actors are hiding OtterCookie malware in SVG flag images within fake coding tests to target developers and steal cryptocurrency.Fri, 17 Jul 2026 17:13:52 GMTLazarus GroupOtterCookieContagious InterviewSteganographyNode JsInfostealerhttps://runtimerebel.com/blog/okobot-framework-multi-payload-data-crypto-theft-attackshttps://runtimerebel.com/blog/okobot-framework-multi-payload-data-crypto-theft-attacksThe new OkoBot framework deploys over 20 distinct payloads, primarily targeting cryptocurrency seed phrases, credentials, and sensitive data.Thu, 16 Jul 2026 21:02:27 GMTOkoBotMalwareInfostealerCryptocurrency TheftCredential TheftData Exfiltrationhttps://runtimerebel.com/blog/clicklock-macos-stealer-how-attackers-coerce-victims-via-app-kill-loopshttps://runtimerebel.com/blog/clicklock-macos-stealer-how-attackers-coerce-victims-via-app-kill-loopsClickLock is a new macOS infostealer that terminates essential system processes every 210ms to force users into disclosing their login passwords.Thu, 16 Jul 2026 14:03:10 GMTmacOSInfostealerClickLockSocial EngineeringPersistencehttps://runtimerebel.com/blog/malicious-github-repositories-infostealer-distribution-threathttps://runtimerebel.com/blog/malicious-github-repositories-infostealer-distribution-threatThreat actors are leveraging nearly 300 fake GitHub repositories, impersonating legitimate software, to distribute infostealer malware.Tue, 14 Jul 2026 21:03:07 GMTGitHubInfostealerMalware DistributionSupply Chain AttackSoftware Impersonationhttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwarehttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwareA malicious version of the Jscrambler npm package, 5.0.0-beta-1, was backdoored with infostealer malware, affecting 1,500 downloads. Immediate action needed.Mon, 13 Jul 2026 20:59:06 GMTJscramblerNPMSupply Chain AttackInfostealerMalwareNode Jshttps://runtimerebel.com/blog/jscrambler-8-14-0-compromised-rust-infostealer-supply-chain-attackhttps://runtimerebel.com/blog/jscrambler-8-14-0-compromised-rust-infostealer-supply-chain-attackThe jscrambler 8.14.0 npm release was compromised with a malicious preinstall hook dropping a cross-platform Rust infostealer. Mitigate the threat now.Sat, 11 Jul 2026 20:50:45 GMTJscramblerNPMSupply Chain AttackRust MalwareInfostealerhttps://runtimerebel.com/blog/busysnake-infostealer-targets-critical-infrastructure-armored-likho-s-ttpshttps://runtimerebel.com/blog/busysnake-infostealer-targets-critical-infrastructure-armored-likho-s-ttpsBusySnake infostealer, deployed by Armored Likho, infiltrates critical infrastructure in Russia, Brazil, and Kazakhstan. Understand their TTPs and mitigation strategies.Tue, 07 Jul 2026 03:34:06 GMTBusySnakeInfostealerArmored LikhoCritical InfrastructureGovernmentElectrical PowerRussiaBrazilKazakhstanhttps://runtimerebel.com/blog/djinn-stealer-targets-cloud-ai-credentials-via-simplehelp-cve-2026-48558https://runtimerebel.com/blog/djinn-stealer-targets-cloud-ai-credentials-via-simplehelp-cve-2026-48558Analysis of Djinn Stealer, an infostealer delivered via critical SimpleHelp CVE-2026-48558, targeting cloud and AI development credentials.Tue, 30 Jun 2026 09:19:57 GMTDjinn StealerCVE-2026-48558SimpleHelpInfostealerCloud SecurityAI CredentialsAuthentication Bypasshttps://runtimerebel.com/blog/amadey-stealc-malware-c2-infrastructure-disruptedhttps://runtimerebel.com/blog/amadey-stealc-malware-c2-infrastructure-disruptedMicrosoft and global allies dismantle the shared C2 infrastructure of Amadey botnet and StealC info-stealer malware, disrupting ongoing cybercrime operations.Wed, 24 Jun 2026 16:52:14 GMTAmadeyStealCMalwareBotnetInfostealerCybercrimeC2 TakedownMicrosofthttps://runtimerebel.com/blog/amadey-stealc-malware-operations-disrupted-by-operation-endgamehttps://runtimerebel.com/blog/amadey-stealc-malware-operations-disrupted-by-operation-endgameOperation Endgame, led by Europol and Microsoft, has disrupted infrastructure supporting Amadey and StealC info-stealer malware, impacting cybercriminal services.Wed, 24 Jun 2026 16:51:44 GMTAmadeyStealCOperation EndgameMalwareInfostealerCybercrimeLaw Enforcementhttps://runtimerebel.com/blog/phantom-stealer-fileless-credential-theft-evasionhttps://runtimerebel.com/blog/phantom-stealer-fileless-credential-theft-evasionPhantom Stealer uses fileless execution and advanced anti-analysis to steal browser credentials. Learn its TTPs and how to detect this evasive malware.Wed, 17 Jun 2026 05:47:27 GMTPhantom StealerFileless MalwareCredential TheftInfostealerBrowser CredentialsAnti Analysishttps://runtimerebel.com/blog/lumma-stealer-distributed-via-fake-editpro-ai-image-generatorhttps://runtimerebel.com/blog/lumma-stealer-distributed-via-fake-editpro-ai-image-generatorThreat actors are leveraging a fake AI image generator website to distribute Lumma Stealer malware targeting both Windows and macOS systems.Sat, 13 Jun 2026 09:17:02 GMTLumma StealerEditPro AIInfostealermacOS MalwareSocial Engineeringhttps://runtimerebel.com/blog/400-arch-linux-aur-packages-hijacked-ebpf-rootkit-and-infostealerhttps://runtimerebel.com/blog/400-arch-linux-aur-packages-hijacked-ebpf-rootkit-and-infostealerAttackers compromised over 400 Arch User Repository (AUR) packages to deploy Rust-based infostealers and eBPF rootkits, targeting developer credentials.Fri, 12 Jun 2026 20:51:23 GMTArch LinuxAURSupply Chain AttackeBPF RootkitInfostealerRust Malwarehttps://runtimerebel.com/blog/aur-compromise-400-packages-distributing-rootkits-and-infostealershttps://runtimerebel.com/blog/aur-compromise-400-packages-distributing-rootkits-and-infostealersOver 400 Arch User Repository (AUR) packages compromised to deploy Linux rootkits and harvest credentials, tokens, and sensitive developer data.Fri, 12 Jun 2026 17:06:24 GMTArch LinuxAURSupply Chain AttackRootkitInfostealerhttps://runtimerebel.com/blog/onyxc2-stealer-enterprise-grade-info-theft-for-250-monthhttps://runtimerebel.com/blog/onyxc2-stealer-enterprise-grade-info-theft-for-250-monthOnyxC2 stealer targets over 200 applications and extensions, using encrypted payloads, DLL sideloading, and in-memory execution to evade detection.Thu, 11 Jun 2026 13:35:59 GMTOnyxC2InfostealerDLL Side LoadingEncrypted PayloadsMalware as a Servicehttps://runtimerebel.com/blog/github-supply-chain-disruption-microsoft-repos-abused-to-host-malwarehttps://runtimerebel.com/blog/github-supply-chain-disruption-microsoft-repos-abused-to-host-malwareGitHub recently disabled 73 official Microsoft repositories after they were targeted in a massive campaign pushing password-stealing malware to developers.Tue, 09 Jun 2026 17:00:46 GMTGitHubMicrosoftSupply Chain AttackInfostealerDevSecOpshttps://runtimerebel.com/blog/python-based-infostealer-masked-as-pdf-targets-browser-credentialshttps://runtimerebel.com/blog/python-based-infostealer-masked-as-pdf-targets-browser-credentialsTechnical analysis of a PyInstaller-compiled infostealer using Discord webhooks to exfiltrate browser credentials, crypto wallets, and session tokens.Tue, 09 Jun 2026 09:19:02 GMTInfostealerPyinstallerDiscord WebhookCredential TheftMalware Analysishttps://runtimerebel.com/blog/ironworm-malware-36-npm-packages-identified-in-supply-chain-attackhttps://runtimerebel.com/blog/ironworm-malware-36-npm-packages-identified-in-supply-chain-attackSecurity researchers discover a campaign delivering IronWorm infostealer malware via 36 malicious npm packages using preinstall script execution hooks.Thu, 04 Jun 2026 17:09:30 GMTNPMIronWormInfostealerSupply Chain AttackJavaScripthttps://runtimerebel.com/blog/acr-stealer-distributed-via-fake-claude-ai-desktop-sitehttps://runtimerebel.com/blog/acr-stealer-distributed-via-fake-claude-ai-desktop-siteThreat actors are distributing ACR Stealer malware through a fraudulent Claude AI desktop application site, targeting browser credentials and crypto wallets.Tue, 26 May 2026 00:55:39 GMTACR StealerClaude AIInfostealerPhishingCredential Thefthttps://runtimerebel.com/blog/analysis-of-cross-platform-npm-stealer-using-discord-webhookshttps://runtimerebel.com/blog/analysis-of-cross-platform-npm-stealer-using-discord-webhooksTechnical teardown of an obfuscated Node.js infostealer targeting Discord tokens, crypto wallets, and browser credentials via cross-platform scripts.Fri, 22 May 2026 09:17:57 GMTNPMNode JsInfostealerDiscord WebhookObfuscationhttps://runtimerebel.com/blog/ukraine-identifies-odesa-based-infostealer-operatorhttps://runtimerebel.com/blog/ukraine-identifies-odesa-based-infostealer-operatorUkrainian cyberpolice and US law enforcement identify an 18-year-old in Odesa suspected of compromising 28,000 accounts for dark web monetization.Thu, 21 May 2026 00:58:31 GMTInfostealerUkraine CyberpoliceData TheftCredential StuffingOdesahttps://runtimerebel.com/blog/shub-macos-infostealer-spoofs-apple-security-updates-installs-backdoorhttps://runtimerebel.com/blog/shub-macos-infostealer-spoofs-apple-security-updates-installs-backdoorA new SHub macOS infostealer variant employs fake Apple security update prompts via AppleScript to install a backdoor, threatening user data and system integrity.Tue, 19 May 2026 00:57:05 GMTSHubmacOSInfostealerAppleScriptBackdoorPhishinghttps://runtimerebel.com/blog/shai-hulud-infostealer-surfaces-in-malicious-npm-package-campaignhttps://runtimerebel.com/blog/shai-hulud-infostealer-surfaces-in-malicious-npm-package-campaignLeaked Shai-Hulud malware is targeting Node.js developers via malicious npm packages, exfiltrating sensitive data and credentials to Telegram-based C2.Mon, 18 May 2026 20:37:20 GMTNPMShai HuludInfostealerSupply Chain AttackMalicious Packageshttps://runtimerebel.com/blog/malicious-windows-11-isos-deliver-vidar-infostealer-analysishttps://runtimerebel.com/blog/malicious-windows-11-isos-deliver-vidar-infostealer-analysisSecurity researchers warn of fake Windows 11 ISO installers delivering Vidar and RedLine infostealers through sophisticated DLL side-loading techniques.Tue, 12 May 2026 05:19:19 GMTVidar StealerWindows 11Iso MalwareDLL Side LoadingInfostealerhttps://runtimerebel.com/blog/compromised-checkmarx-jenkins-plugin-spreads-infostealerhttps://runtimerebel.com/blog/compromised-checkmarx-jenkins-plugin-spreads-infostealerOfficial Checkmarx Jenkins AST plugin version 2023.2.7 was compromised with an infostealer, risking credentials and system data.Tue, 12 May 2026 00:48:58 GMTCheckmarx ASTJenkinsInfostealerSupply Chain AttackSoftware Supply ChainPlugin CompromiseCredential Thefthttps://runtimerebel.com/blog/fake-openai-privacy-filter-repository-distributes-rust-info-stealerhttps://runtimerebel.com/blog/fake-openai-privacy-filter-repository-distributes-rust-info-stealerA malicious Hugging Face repository impersonating OpenAI's privacy tool reached 244k downloads, delivering a Rust-based information stealer to Windows users.Mon, 11 May 2026 09:17:45 GMTHugging FaceOpenAIInfostealerRustSupply Chain AttackMalicious Repositorieshttps://runtimerebel.com/blog/claude-ai-malvertising-how-attackers-abuse-shared-chats-for-macos-malwarehttps://runtimerebel.com/blog/claude-ai-malvertising-how-attackers-abuse-shared-chats-for-macos-malwareThreat actors are leveraging Google Ads and legitimate Claude.ai shared chats to distribute macOS infostealers, effectively bypassing traditional web filters.Sun, 10 May 2026 20:19:55 GMTmacOS MalwareClaude AIGoogle AdsMalvertisingInfostealerCuckoohttps://runtimerebel.com/blog/fake-openai-hugging-face-repository-distributes-infostealer-malwarehttps://runtimerebel.com/blog/fake-openai-hugging-face-repository-distributes-infostealer-malwareAttackers leveraged a fraudulent OpenAI repository on Hugging Face to distribute infostealers. Learn to detect and mitigate these AI supply chain threats.Sat, 09 May 2026 16:22:38 GMTHugging FaceOpenAIInfostealerSupply Chain AttackSocial Engineeringhttps://runtimerebel.com/blog/clickfix-attacks-distribute-vidar-stealer-acsc-warning-mitigationhttps://runtimerebel.com/blog/clickfix-attacks-distribute-vidar-stealer-acsc-warning-mitigationThe ACSC warns Australian organizations of active ClickFix social engineering attacks deploying Vidar Stealer malware, risking data theft. Learn detection and mitigation.Thu, 07 May 2026 20:33:35 GMTVidar StealerClickFixSocial EngineeringACSCInfostealerAustraliahttps://runtimerebel.com/blog/google-chrome-abe-bypass-heightened-infostealer-threathttps://runtimerebel.com/blog/google-chrome-abe-bypass-heightened-infostealer-threatVoidStealer Trojan authors bypass Google Chrome's App-Bound Encryption (ABE), enabling infostealers to exfiltrate cookies and credentials from users.Thu, 07 May 2026 00:51:02 GMTGoogle ChromeApp Bound EncryptionABE BypassVoidStealerInfostealerData Exfiltrationhttps://runtimerebel.com/blog/lofygang-targets-minecraft-players-with-lofystealer-malwarehttps://runtimerebel.com/blog/lofygang-targets-minecraft-players-with-lofystealer-malwareBrazilian cybercrime group LofyGang resurfaces after three years, deploying LofyStealer (GrabBot) disguised as a Minecraft 'Slinky' hack to steal player credentials.Tue, 28 Apr 2026 20:34:56 GMTLofyGangLofyStealerGrabBotMinecraftInfostealerCybercrimehttps://runtimerebel.com/blog/malicious-pypi-package-elementary-data-hijacked-for-infostealerhttps://runtimerebel.com/blog/malicious-pypi-package-elementary-data-hijacked-for-infostealerHigh-profile supply chain attack on the elementary-data PyPI package compromises developer credentials and crypto wallets via account takeover. Patch now.Mon, 27 Apr 2026 16:40:27 GMTPyPIElementary DataInfostealerPython SecurityAccount Takeoverhttps://runtimerebel.com/blog/python-infostealer-targeting-browser-credentials-and-discord-tokenshttps://runtimerebel.com/blog/python-infostealer-targeting-browser-credentials-and-discord-tokensTechnical analysis of a Python-based infostealer leveraging Discord webhooks for exfiltration, targeting browser credentials and session tokens.Tue, 21 Apr 2026 08:46:00 GMTPython MalwareInfostealerDiscord WebhooksCredential TheftBrowser Securityhttps://runtimerebel.com/blog/lumma-stealer-and-sectop-rat-dual-infection-chain-analysishttps://runtimerebel.com/blog/lumma-stealer-and-sectop-rat-dual-infection-chain-analysisTechnical breakdown of the Lumma Stealer and Sectop RAT (ArechClient2) infection chain, detailing C2 communication and persistence mechanisms.Fri, 17 Apr 2026 08:45:30 GMTLumma StealerSectop RATArechclient2InfostealerThreat Intelligencehttps://runtimerebel.com/blog/storm-infostealer-bypassing-local-decryption-for-session-hijackinghttps://runtimerebel.com/blog/storm-infostealer-bypassing-local-decryption-for-session-hijackingStorm infostealer exfiltrates encrypted browser data for server-side decryption, allowing attackers to bypass MFA and hijack active user sessions.Mon, 13 Apr 2026 16:33:45 GMTStormInfostealerSession HijackingCredential TheftVaronishttps://runtimerebel.com/blog/chrome-dbsc-securing-session-cookies-with-device-binding-analysishttps://runtimerebel.com/blog/chrome-dbsc-securing-session-cookies-with-device-binding-analysisGoogle introduces Device Bound Session Credentials in Chrome to combat session hijacking by cryptographically linking authentication cookies to local hardware.Fri, 10 Apr 2026 08:38:17 GMTGoogle ChromeDBSCSession HijackingCookie TheftInfostealerhttps://runtimerebel.com/blog/infinity-stealer-macos-malware-analyzing-clickfix-lures-and-payloadshttps://runtimerebel.com/blog/infinity-stealer-macos-malware-analyzing-clickfix-lures-and-payloadsInfinity Stealer targets macOS via ClickFix social engineering. Learn how this Nuitka-compiled malware steals browser data, crypto wallets, and Keychain info.Sat, 28 Mar 2026 16:13:39 GMTmacOSInfinity StealerInfostealerNuitkaClickFixSocial Engineeringhttps://runtimerebel.com/blog/backdoored-telnyx-pypi-package-uses-steganography-to-deliver-malwarehttps://runtimerebel.com/blog/backdoored-telnyx-pypi-package-uses-steganography-to-deliver-malwareSecurity researchers discovered malicious versions of the Telnyx PyPI package delivering infostealers via steganography hidden in WAV audio files.Sat, 28 Mar 2026 00:36:31 GMTPyPITelnyxSteganographyInfostealerTeamPCPPython Securityhttps://runtimerebel.com/blog/github-malware-campaign-fake-vs-code-alerts-target-developershttps://runtimerebel.com/blog/github-malware-campaign-fake-vs-code-alerts-target-developersAttackers exploit GitHub Discussions to push malware via fake VS Code security alerts. Learn the TTPs used to target developers and how to mitigate risk.Fri, 27 Mar 2026 20:15:23 GMTGitHubVisual Studio CodePhishingMalwareInfostealerDeveloper Security