Stealerium Changing the Rules of Cyber Espionage

Stealerium: The Open-Source Infostealer Reshaping Cyber Espionage

Summary

First appearing in 2022 as an open-source .NET-based information stealer, Stealerium has evolved into one of the most dangerous cyber-espionage tools active today. Its resurgence in 2025 is marked by fear-driven and financial-themed campaigns targeting non-profits, hospitality, travel, education, finance, legal, and banking sectors worldwide.

Stealerium’s versatility, extensive data theft capabilities, and multiple exfiltration channels make it a favored tool for both low-skilled actors and advanced cybercriminals. It has been observed in phishing campaigns using charity impersonation, financial lures, and court summons-themed emails. Its growing ecosystem, which includes Phantom Stealer and Warp Stealer, underscores its role in the commoditization of malware.

Attack Details

• Origins: Released on GitHub as “for educational purposes,” quickly adopted and weaponized by malicious actors.

• Campaigns:

  • May 2025 – TA2715 impersonated a Canadian charity using compressed executables to drop Stealerium.

  • June 2025 – TA2536 launched a financial-themed lure spoofing Garanti BBVA, distributing Stealerium via payment-themed emails.

  • June 2025 – Hospitality/travel booking campaigns used compressed files to infect victims.

  • July 2025 – “Court Summons” phishing delivered IMG files with VBScripts to execute Stealerium payloads.

• Capabilities:

  • Wi-Fi Enumeration: Executes netsh wlan commands to collect stored profiles for possible lateral movement.

  • Persistence: Creates PowerShell exclusions and scheduled tasks.

  • Browser Exploitation: Enables Chrome remote debugging to steal cookies and credentials.

  • Data Theft: Harvests browser credentials, banking info, crypto wallets, email/chat data, VPN creds, gaming tokens, confidential files, screenshots, and webcam footage—potentially used for blackmail.

  • Exfiltration: Uses SMTP, Discord webhooks, Telegram, Gofile, and Zulip for data exfiltration.

  • Anti-Analysis: Employs random execution delays, blocklists of usernames/IPs/GPUs, and self-deletion if sandboxed.

• Related Malware: Shares significant code overlap with Phantom Stealer and Warp Stealer, strengthening its position as a modular malware family.

Recommendations

• Strengthen Email Security: Use advanced filtering to block compressed executables, VBScript, and JavaScript payloads.

• Enforce MFA and Strong Passwords: Protect email, browser, and VPN accounts with MFA and regular password hygiene.

• Monitor Network Traffic: Detect suspicious use of netsh wlan and outbound connections to SMTP, Discord, Telegram, or unusual domains.

• Disable Remote Debugging: Turn off unnecessary browser features to prevent cookie and credential theft.

• Deploy EDR/XDR: Leverage behavioral detection to identify PowerShell exclusions, scheduled task creation, and anti-analysis tactics.

Indicators of Compromise (IoCs)

SHA256 Hashes

• d4a33be36cd0905651ce69586542ae9bb5763feddc9d1af98e90ff86a6914c0e

• 41700c8fe273e088932cc57d15ee86c281fd8d2e771f4e4bf77b0e2c387b8b23

• b640251f82684d3b454a29e962c0762a38d8ac91574ae4866fe2736f9ddd676e

• a00fda931ab1a591a73d1a24c1b270aee0f31d6e415dfa9ae2d0f126326df4bb

• e590552eea3ad225cfb6a33fd9a71f12f1861c8332a6f3a8e2050fffce93f45e

• 50927b350c108e730dc4098bbda4d9d8e7c7833f43ab9704f819e631b1d981e3

MITRE ATT&CK TTPs

• Initial Access: T1566 (Phishing), T1566.001 (Spearphishing Attachment)

• Execution: T1059 (Command & Scripting Interpreter), T1059.001 (PowerShell), T1059.005 (Visual Basic), T1059.007 (JavaScript), T1204 (User Execution)

• Persistence: T1053 (Scheduled Task/Job)

• Defense Evasion: T1562 (Impair Defenses), T1562.001 (Disable or Modify Tools), T1480 (Execution Guardrails), T1027 (Obfuscation), T1497 (Sandbox Evasion)

• Credential Access: T1555 (Credentials from Password Stores), T1555.003 (Credentials from Web Browsers), T1056.001 (Keylogging), T1056.003 (Web Portal Capture)

• Discovery: T1082 (System Information Discovery), T1087 (Account Discovery), T1046 (Network Service Discovery)

• Lateral Movement: T1021 (Remote Services)

• Collection: T1115 (Clipboard Data), T1113 (Screen Capture), T1005 (Data from Local System), T1213 (Data from Information Repositories), T1114 (Email Collection)

• Exfiltration: T1567 (Exfiltration Over Web Service), T1048 (Exfiltration Over Alternative Protocol)

• Command & Control: T1102 (Web Service), T1573 (Encrypted Channel)

• Impact: T1490 (Inhibit System Recovery), T1565 (Data Manipulation)

References

• Proofpoint – Investigating Stealerium and Phantom Infostealers

• MITRE ATT&CK Techniques