Blub
Blub is a custom browser-data and credential-stealing malware used by the Iran-aligned cyberespionage group MuddyWater (also tracked as Mango Sandstorm and TA450). Reporting describes it as a C/C++ browser-data stealer deployed post-compromise alongside other credential theft tools such as CE-Notes and LP-Notes. Its documented capability is to extract login data from Google Chrome, Microsoft Edge, Mozilla Firefox, and Opera browsers. Blub was observed in MuddyWater campaigns active between September 2024 and March 2025 that primarily targeted organizations in Israel, with at least one confirmed target in Egypt; affected sectors included technology, engineering, manufacturing, local government, and education. In the broader operation, initial access was typically obtained via spearphishing emails with PDF attachments linking to installers for legitimate remote monitoring and management tools hosted on file-sharing services such as OneHub, Egnyte, and Mega. No specific Blub indicators of compromise are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
As part of the operation, MuddyWater also deployed several custom credential stealers, including CE-Notes, LP-Notes, and Blub, to extract browser passwords, login credentials, and other sensitive data.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Browser-data stealer used in the described MuddyWater toolchain to collect browsing-related data.
Browser credential stealer that extracts login data from Chrome, Edge, Firefox, and Opera.
Credential stealer that extracts login data from Chrome, Edge, Firefox, and Opera browsers.
A C/C++ browser-data stealer that collects user login data from major browsers.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.