Threat Spotlight: "Haskers Gang" Introduces New Zingo Stealer
Summary: Cisco Talos reports that the Haskers Gang, a crimeware group active since at least January 2020 and likely based in Eastern Europe, announced in early March 2022 a new information stealer called ZingoStealer, offered free to members of its Telegram community and sold with its ExoCrypt crypter for 300 Rubles (~$3 USD). The obfuscated .NET malware stages browser credentials, Discord and Telegram tokens, cryptocurrency wallet data, screenshots and system information in a GinzoFolder directory, exfiltrates the archive to an attacker server, and pulls secondary payloads such as RedLine Stealer and the XMRig miner from a URL list called ginzolist.txt.
Key Takeaway: The author later announced transfer of ZingoStealer ownership and offered the source code for $500, meaning a free stealer with a $3 evasion option is now circulating among thousands of Telegram and Discord community members and can be rebranded by anyone who pays.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026