Malware

SolarMarker

SolarMarker is a sophisticated malware family and backdoor, also known as Deimos, Jupyter Infostealer, Polazert, and Yellow Cockatoo, that has been active since at least September 2020. The provided content describes it as an SEO-poisoning backdoor with infostealer capability. It has been used in classic search-engine-optimization poisoning campaigns that rely on tiered infrastructure and content farms to attract victims through search results and route them through filtering gates. SolarMarker is capable of stealing data from multiple web browsers and cryptocurrency wallets, and it can deploy additional payloads. The content also notes infrastructure associations: servers clustered with malicious activity were linked alongside BumbleBee, Raccoon Stealer, RecordBreaker, and SolarMarker, and one referenced sample contained a HuggingFace API key. The content recommends organizational controls against SolarMarker but does not provide specific mitigations or high-confidence IOCs beyond these infrastructure and sample references.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1608.006SEO PoisoningEvidence1

Classic Search Engine Optimization (SEO) poisoning already proved resilient at scale: SolarMarker and peers used tiered infrastructure and content farms to meet victims at intent, then route them through filtering gates.

Execution

1 technique

T1574.011Services Registry Permissions WeaknessEvidence1

The implant executes various commands, which are inserted into the registry key HKCU\ Classes\ms-settings\CurVer . It then tries to execute two different Windows components ... fodhelper.exe ... ComputerDefaults.exe

Persistence

1 technique

T1112Modify RegistryEvidence1

The implant executes various commands, which are inserted into the registry key HKCU\ Classes\ms-settings\CurVer... creates registry keys to register a custom file extension and a custom command to open files of that extension.

Stealth

1 technique

T1574.011Services Registry Permissions WeaknessEvidence1

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

1 technique

T1552.001Credentials In FilesEvidence1

Developers routinely hardcode credentials directly into apps, config files, and scripts. These credentials can be found in GitHub in open-source projects, while closed-source projects contain the credentials in the app itself.

Collection

1 technique

T1005Data from Local SystemEvidence1

Among the malware families in the intro table, LameHug/PROMPTSTEAL is the cleanest example of this route in the wild: it calls HuggingFace’s Inference API for Qwen 2.5-Coder-32B-Instruct to drive reconnaissance and data theft...

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app28 days ago

domain●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

intezer blogNews

Jun 3, 2026

How attackers are gaining access to LLM inference - Intezer

SEO-poisoning backdoor with infostealer capability; one sample was found carrying a HuggingFace API key.

recordedfutureNews

Aug 26, 2025

How Threat Actors Are Rizzing Up Your AI for Profit

SolarMarker is portrayed as malware associated with SEO poisoning campaigns that use tiered infrastructure and content farms to lure victims and route them through filtering infrastructure.

osint team blogNews

Nov 28, 2023

Infrastructure Analysis: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability | by Joshuapenny | OSINT Team

Malware associated with a subset of the investigated infrastructure; mentioned alongside other malware families found on related servers.

trend micro researchNews

May 30, 2023

Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals

Backdoor referenced as another malware family whose binaries were signed using certificates tied (via infrastructure analysis) to the same broader signing ecosystem.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.