Typhon Reborn With New Capabilities
Summary: Cyble Research Labs uncovered Typhon Stealer, a crypto miner and stealer sold for hire, in early August 2022, and the author soon released an updated version called Typhon Reborn with more anti-analysis techniques and improved stealer and file grabber features. The author advertised it on an underground website and Telegram channel at $100 for a lifetime subscription, with a compressed payload of roughly 2.3 MB, while removing the keylogger, clipper, miner and worm features and adding a crypto-extension stealer for Google Chrome and Microsoft Edge.
Key Takeaway: A $100 lifetime stealer with a configurable builder lowers the skill needed to steal crypto wallets and Wi-Fi passwords, and its MeltSelf routine deletes itself from disk whenever it detects analysis tools, sandbox usernames, or a debug flag.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026