- Discovery and Features of Styx Stealer
- Developer's Mistake and Data Leak
- CPR Investigation and Consequences
Check Point Research (CPR) uncovered a new malware called Styx Stealer, capable of stealing browser data, cryptocurrency, and instant messenger sessions. This malware is a variant of Phemedrone Stealer, featuring new functionalities.
Discovery and Features of Styx Stealer
According to CPR, Styx Stealer is an updated version of Phemedrone Stealer. The new variant includes features like auto-start and crypto-clipping.
Developer's Mistake and Data Leak
During debugging, a developer linked to the Agent Tesla threat actor known as 'Fucosreal' made a critical mistake, leaking sensitive data. This allowed CPR researchers to gather intelligence on clients, profits, and personal details.
CPR Investigation and Consequences
The investigation revealed that Styx Stealer is based on an older version of Phemedrone Stealer, lacking some advanced features. The developer's failure in operational security compromised the campaign, allowing CPR to identify the involved individuals, their locations, and personal details.
The discovery of Styx Stealer underscores the importance of operational security in malware development and illustrates how a single mistake can lead to significant consequences for cybercriminals.
