Typhon Reborn V2: Updated stealer features enhanced anti-analysis and evasion capabilities
Summary: Typhon Reborn V2, an information stealer sold for $59 per month or $540 for a lifetime subscription, was announced on the Russian-language XSS forum on Jan. 31, 2023, with samples in public repositories dating to December 2022. Cisco Talos confirmed the developer's claims of a refactored codebase, finding expanded anti-analysis and anti-virtualization checks, Base64 and XOR string obfuscation, geolocation avoidance including a RunAntiCIS feature, and removal of reboot persistence so the malware terminates after exfiltrating data via Telegram.
What you should know: At $59 a month, and with payment records suggesting multiple adversaries have already bought access, this stealer is priced to spread widely - and its checks for debuggers, sandboxes, analysis tools and hosting-provider IP ranges mean your detection stack may never see it run.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026