🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including a banker that swaps IBANs and rewrites transfer amounts in banking sessions. #ATSBanker. Banker swapping IBANs and rewriting transfer amounts. Sample analysis report: reports.threatray.com/5defd6… #LithiumCrypter #CherryStealer #CinderRAT #RuntimeBreaker #ChickenStealer #ConquerRAT #PhanterStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a HTTP-polling C++ RAT with Chromium ABE stealer and WMI persistence. #IronRAT. RAT with Chromium ABE stealer and WMI persistence. Sample analysis report: reports.threatray.com/d34f0e… #DPPBotRAT #TakerStealer #NoobSaibotRAT #YamiStealer #AudaxStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a multi-tenant .NET banker targeting Portuguese Santander customers. #KrasnyBanker. Banker targeting Portuguese Santander customers. Sample analysis report: reports.threatray.com/88694d… #CookieGrab_ABE #GiaPhucStealer #AntigravityAdvancedStealer #VantaRAT #CollextorRAT #JJMStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including 3 of these families using Discord: 2 stealers send stolen data to Discord webhooks and a RAT controlled through a Discord bot. #VexioStealer. Discord-webhook stealer grabbing browsers, Wi-Fi, screenshots. Sample analysis report: reports.threatray.com/27bef9… #SentyStealer. Rust Discord stealer. Sample analysis report: reports.threatray.com/ae1cde… #MonitorRAT. Discord-bot RAT with Cloudflare Workers config. Sample analysis report: reports.threatray.com/53e5b7… #BSTStealer #NIKRAT #MegaRAT 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a a Valorant cheat loader that conceals a stealer. #Iceg3nStealer. Valorant cheat loader hiding a stealer. Sample analysis report: #LLHNStealer #FractureRAT #ExistRAT #ApocOmega #XLogStealer #Fl1xxStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🪶 We recovered five #SparroWocky payloads, four of them previously unreported — including a variant not covered in @ESETresearch’s writeup: it drops the Mbed TLS stack entirely and communicates with its C&C using DNS over port 53. SparroWocky is #FamousSparrow's new flagship backdoor, replacing SparrowDoor: welivesecurity.com/en/eset-r… The backdoor itself never touches disk. Instead, it is reflectively loaded from an encrypted .dat container with the MZ and PE magic values stripped. So we hunted the container rather than the implant. ESET documented its layout: a 4-byte magic (0x11328712), config size, payload size, followed by a 16-byte RC4 key. Decrypting the payload with the key at offset 12 and restoring the stripped PE magic values recovers the backdoor. Of the five payloads we recovered, one was documented by ESET. The other four were previously unreported and revealed three new C&C IPs — plus the first domain-based C&C seen for this family. e0b6f8535e19f0a4938e3317de0c4493ecea17aa906fd0454805ba2086cbf3a8 (reported by ESET) d08e09a17df22fb39838dcc9e99756830ef5175bc9e03d615adf979dc85ed052 4e8a3ca7be64c7d546598483bcf0f16023c1cac5506f400ba736c6b42daf1d73 (DNS variant) ef9e3e831b736b79561abeb4acf5acbb154b406ea245498a03f55715fc6bc73b bb284f7977fc0251274f6188d6dd64d1bc95004a00b9ba7c8420a2c0f461ebf1 38.54.45[.]155 38.54.89[.]158 77.111.101[.]153 .files.seosnskorea[.]com 🔎 The most interesting find is the DNS variant. 4e8a3ca7 retains the core SparroWocky implementation — same container format, reflective PE loader, and inline-hook engine — but changes its configuration and C&C communication. Instead of the tab-separated config, it uses a length-prefixed TLV structure. It targets a domain rather than a bare IP and replaces Mbed TLS with a DNS client subsystem communicating over port 53. Sample report: reports.threatray.com/abf0f8… We also recovered four previously unreported loaders. All four are patched copies of the same legitimate WinFsp DLL, in two build groups — one pair keeps the original six sections, the other adds an .idata section rebuilt over the Authenticode signature. Each patches a different region of .text and redirects the PE entry point into it. 🧬 Find the #IOCs here: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including a Rust implant with hVNC and lateral movement. #DolphinX. Rust implant with hVNC and lateral movement. Sample analysis report: reports.threatray.com/f77e09… #EqSteal #RaffleStealer #LuzixStark #ProjectStealer #OnyxC2 #AestheticStealer #WorstStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a stealer that exfiltrates via a Cloudflare Worker. #FlowzifritStealer. Cloudflare worker. Sample analysis report: reports.threatray.com/d12803… #KhaiDiGrabber #ChromeExtractor #ProjectZStealer #SaturnStealer #RedDelphin #LiveMicRAT 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a stealer that sends the stolen data as issue bodies to GitHub. #AkhassatStealer. Stolen data is POSTed as GitHub issue bodies. Sample analysis report: reports.threatray.com/5c7779… #CapyAgent #ZyxStealer #FearStealer #CarsoRansomware #OpnKeyRansomware 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 7 new families spotted, including a RAT that is controlled with a Discord bot. #JumpscareRAT. Discord-bot-controlled RAT. Sample analysis report: reports.threatray.com/7ebc2c… #CtfCookieExtractor #LpxiterDownloader #ArvionRAT #SnakeBiteRAT #XenRAT #NimdesStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including a stealer that exfiltrates to a Discord webhook and later wipes user data. #PrefireWiper. Exfiltrates user data to a Discord webhook and then wipes all the information. Sample analysis report: reports.threatray.com/b81544… #EdgeRAT #AokigaharaStealer #YoucefGrabber #RobHook #DeekStealer #SbcfgRAT #f4maxStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a ransomware that offers the decryption routine through Telegram. #SuperboyKing. Decryption routine obtained through Telegram. Sample analysis report: reports.threatray.com/bbef20… #PostureStealer #HeroinRAT #WaterStealer #ShiverStealer #KlisatuLoader 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 5 new families spotted, including various stealers using Telegram for exfiltration. #RavenStealer. Stealer exfiltrating through Telegram. Sample analysis report: reports.threatray.com/461ff1… #Zlogger #GoTelegramStealer #AsterStealer #BlackStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including a stealer that exfiltrates via the Discord Bot API. #FudRAT — Exfiltrates via the Discord Bot API. Sample analysis report: reports.threatray.com/3300c8… #ElitraFly #GolstaStealer #DojinerBackdoor #MelloDiscordTokenStealer #OsuStealer #HealrktRAT #NeedleStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a wiper masquerading as a 'Fortnite Account Puller’ exfiltrating via Discord. #FAPWiper — A wiper masquerading as a ‘Fortnite Account Puller’, exfiltrating via Discord. Sample analysis report: reports.threatray.com/1f4d0d… #GalaxyRAT #StanleyRAT #PrettyDerbyStealer #GrimSpectorStealer #BaneStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎭 We're tracking a new Go-based infostealer we call #VeilStealer — named after the VEIL_RUN / RunVeil markers embedded in the binaries. It's built on a trojanized copy of Equilotl, the legitimate Go installer for the open-source Discord client mod #Equicord. The sample installs the genuine mod as a decoy, then reuses its app.asar patching routine to implant a stealer into the Discord client itself. It carries routines for Discord token theft, browser cookie theft via AppBound/DPAPI, crypto wallet theft, and AI/LLM API-key theft. The AI-key routine is the notable part. It enumerates ~18 provider variables (OpenAI, Anthropic, Google/Gemini, Mistral, Cohere, DeepSeek, xAI, GitHub token …) across four sources: process environment variables, known AI-tool config paths (e.g. ~/.anthropic, ~/.claude), shell startup files, and project .env files. Matching config and .env files are staged to %TEMP% for exfiltration. AI credentials remain a less commonly targeted asset class in commodity stealers. It persists as a fake Windows Font Cache service via a Run key and terminates Discord before patching it. Exfiltration goes to a hardcoded Discord webhook. We discovered 11 samples via our code-similarity engine; all first observed on VT on 2026-06-30 within hours of each other and beaconing to the same webhook. Sample analysis: reports.threatray.com/68ce76… 🧬 Find the #YARA rule and #IOCs here: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 8 new families spotted, including one ransomware family using Discord for data exfiltration and another using Telegram. #TokyoCoreRansomware — Ransomware using Discord webhook for exfiltration. Sample analysis report: reports.threatray.com/9da625… #LiberlyCrypt — Ransomware using Telegram for exfiltration. Sample analysis report: reports.threatray.com/533780… #NyxStealer #EstivStealer #InteriumRAT #ShyGuyRAT #MedusaStealer #GajendraStealer 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 6 new families spotted, including a stealer abusing webhook.site. #INZStealer — Abusing webhook.site for exfil. Sample analysis report: reports.threatray.com/034832… #MSDuckStealer — Stealer with ransomware capabilities #ShitRAT #BrainCrypt #BrunoBackdoor #KaboomWorm 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…

🎯 It’s #ThreatrayTuesday — a weekly drop of new malware families we spot in the wild. This week, 5 new families spotted, including stealers exfiltrating through Discord webhook. #SilvaTweaksStealer — Discord webhook exfiltration. Sample analysis report: reports.threatray.com/cb5d68… #317PremiumStealer — Discord webhook exfiltration #VollmondStealer — Discord webhook exfiltration #ColorbotStealer #SilentEncryptor 🧬 Full #IOCs and analysis reports: github.com/threatray/threat-…