Gremlin Stealer: New Stealer on Sale in Underground Forum
Summary: Unit 42 researchers identified Gremlin Stealer, a C# information-stealing malware sold on a Telegram group since mid-March 2025, with a code base strikingly similar to Hannibal Stealer and reportedly a variant of Sharp Stealer. It captures browser cookies and saved passwords, clipboard data, crypto wallet files, FTP and VPN credentials, Telegram and Discord session data, and credit card information, then uploads the data as a ZIP archive to a server at 207.244.199[.]46.
Key Takeaway: The seller claims to have uploaded vast amounts of data from victims' machines to a server that currently displays 14 ZIP archives of stolen data - and the malware bypasses Chrome's cookie v20 protection, the control many organizations rely on to keep session tokens out of reach.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026