What is information stealer?

information stealer

highMalware

PhantomRaven npm Stealer Linked to LLM-Assisted Development by Financially Motivated Actor

A financially motivated threat actor has been linked to the development and distribution of a JavaScript-based information stealer named PhantomRaven via the npm package registry. Researchers assess with high confidence that the malware was likely written using a large language model (LLM), based on verbose comments, placeholder code, and statistical token-analysis patterns. The campaign poses a supply chain risk to npm users and downstream consumers.

The Hacker News10 days ago2 min read

highMalware

HBO Max Reddit Account Compromised to Distribute ClickFix Malware Campaign

Cyber threat actors compromised the official HBO Max Reddit account and used it to promote malicious advertisements. These ads leveraged ClickFix social engineering tactics to trick users into executing commands that installed information-stealing malware on both Windows and macOS systems. The incident highlights the growing risk of threat actors targeting high-profile social media accounts to distribute malware through trusted brand channels.

BleepingComputer15 days ago1 min read

highMalware

REVSTEALER Associated Modules Disable Windows Update and Defender for Crypto Mining

Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, a Windows information stealer. One of these modules, ProManager, disables Windows Update and Microsoft Defender before executing a cryptocurrency miner. The modules remain on the machine after the stealer deletes itself, providing persistent access for malicious activities.

The Hacker News24 days ago1 min read

highMalware

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint and network behaviors across changing infrastructure. The malware's lifecycle from payload retrieval through data collection, staging, and exfiltration was traced, with the rotating domain infrastructure observed to aid evasion of static blocklists.

The Hacker Newsabout 1 month ago1 min read

highMalware

16 Typosquatted RubyGems Packages Deploy Information Stealer Targeting Credentials and Crypto Wallets

A typosquatting campaign has been identified distributing malicious RubyGems packages designed to steal browser-stored credentials and cryptocurrency wallet data from Windows users. Researchers from OpenSourceMalware are tracking the threat under the moniker "StubMaker." The campaign includes packages with names intentionally similar to legitimate projects, relying on user error during installation. Analysis indicates the packages execute an information stealer upon installation, targeting data stored in browsers and cryptocurrency wallet applications. The discovery was reported on August 18, 2026.

The Hacker Newsabout 1 month ago1 min read

highMalware

AmnesiaStealer Targets macOS Chromium Browsers via Counterfeit GitHub Pages

Researchers have identified AmnesiaStealer, a new macOS-oriented information stealer written in Rust, capable of hijacking Chromium-based browsers to steal session data and potentially grant live browser control. The malware is distributed through fraudulent GitHub download pages that impersonate legitimate software, employing ClickFix-style social engineering to trick users into executing the payload.

The Hacker Newsabout 1 month ago1 min read

information stealer

Quick answers

Related Articles

PhantomRaven npm Stealer Linked to LLM-Assisted Development by Financially Motivated Actor

HBO Max Reddit Account Compromised to Distribute ClickFix Malware Campaign

REVSTEALER Associated Modules Disable Windows Update and Defender for Crypto Mining

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

16 Typosquatted RubyGems Packages Deploy Information Stealer Targeting Credentials and Crypto Wallets

AmnesiaStealer Targets macOS Chromium Browsers via Counterfeit GitHub Pages