Nexus Logger: A New Cloud-based Keylogger Enters the Market
Summary: Unit 42 discovered a new cloud-based keylogger called NexusLogger, built on the Microsoft .NET Framework at a low level of sophistication, which collects keystrokes, system information, stored passwords and screenshots, and specifically harvests game credentials for UPlay, Minecraft, Steam and Origin. Researchers identified 134 unique samples and only 400 unique attacks, 94% delivered via SMTP or POP3, with the nexuslogger[.]com domain first registered on December 18, 2016 and flagged as malicious by Palo Alto Networks.
What's compelling: The malware's embedded incrementing attacker ID suggests roughly 275 unique users have purchased NexusLogger since it was created, sold in tiers from $7 to $199 and paid for via PayPal or bitcoin through rocketr.net - a working commercial market for credential theft at commodity prices.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026