Sapphire Stealer: Open-source information stealer enables credential and data theft
Summary: SapphireStealer is a .NET information stealer whose codebase was published on GitHub on Dec. 25, 2022, with newly compiled samples uploaded to public malware repositories from mid-January 2023 through the first half of 2023. It terminates running browser processes, dumps credential databases into a Passwords.txt file, captures a screenshot, grabs files from the Desktop by extension, and exfiltrates the compressed log.zip via SMTP, with later variants using Discord webhooks and the Telegram posting API.
What you should know: The stolen logs are often sold on to other actors who use the network access for espionage or ransomware, so a single infection can seed a later, larger intrusion. Because the code is open source and multiple distinct threat actors are already compiling and refining it, the barrier to entry for financially motivated cybercrime keeps falling.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026