Needle
Needle is a crimeware-as-a-service / malware-as-a-service platform described as a crypto-stealer and broader theft framework. Reported capabilities include a browser wallet spoofer targeting MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Rabby, Keplr, OKX Wallet, and Brave Wallet; a desktop wallet spoofer targeting Ledger, Trezor, Exodus, Atomic, Guarda, TonKeeper, Zelcore, and Coinomi; and theft across Ethereum, BSC, Polygon, Solana, Tron, Bitcoin, Litecoin, Dogecoin, Avalanche, Arbitrum, Optimism, and Base. Needle Core was reported to support password theft, cookie theft, credit card theft, autofill theft, token theft, browser history collection, extension data theft, browser key theft, FTP credential theft, Telegram session theft, wallet file theft, screenshots, system information collection, form grabbing, and clipboard hijacking. The platform also includes a builder system and launcher system for generating custom payloads with per-build API keys and configurable options, plus Telegram-integrated notifications using bot tokens and chat IDs for stealer logs, wallet spoofer hits, and panel events.
Needle has been linked to a Phorpiex/Trik delivery chain. In the documented campaign, a Phorpiex worm dropper downloaded seven payloads from 178.16.54[.]109, saved them to %TEMP% via URLDownloadToFileW, and executed them with ShellExecuteW. The dropper created %TEMP%\d3333333333333333333333.txt as an infection marker and checked IsDebuggerPresent before proceeding. Retrieved payloads included xmrget.exe, xmr.exe, peinf.exe, 1.exe, 2.exe, 3.exe, and 4.exe. xmrget.exe deployed XMRig as sysmgnrsv.exe and persisted via HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Config; peinf.exe contained the string TWIZTPEINF and harvested files and installed-software paths for exfiltration; and 2.exe fetched credential batches from 130.12.180[.]190/2/ and sent sextortion spam through victim SMTP accounts. The operation also used a private Monero mining pool on 178.16.54[.]109:6060.
The platform exposes operator/customer web panels on TCP port 3000. Researchers identified a live Needle panel at 178.16.54[.]109:3000 and later mapped nine live Needle MaaS panels across multiple providers and ASNs. Common panel fingerprints included HTTP 200 on /, root HTML title "Needle," a Vite/React SPA bundle under /assets/index-<hash>.js, and a healthy /api/v2/health endpoint. Authenticated API routes included /api/v2/users, /api/v2/settings, and /api/v2/launcher/builds, using Bearer token authentication; client-side storage of localStorage["auth_token"] and CORS Access-Control-Allow-Origin: * were observed. Distinct bundle hashes and sizes across the nine panels indicated separately compiled multi-tenant deployments. The captured JavaScript bundles were specifically described as client-side operator-panel UI code rendering the browser-stealer panel UI, not the Phorpiex worm, wallet-drainer stage, or Monero miner payloads.
Needle infrastructure and indicators directly mentioned in the content include 178.16.54[.]109:3000 (panel), 178.16.55[.]234:3000 (panel), 193.24.123[.]23:3000, 94.26.83[.]82:3000, 95.179.181[.]208:3000, 45.151.106[.]204:3000, 144.31.151[.]223:3000, 130.12.180[.]135:3000, and 209.17.118[.]17:3000; the private Monero pool at 178.16.54[.]109:6060; and the spam coordination server at 130.12.180[.]190. Additional observables include the Phorpiex dropper SHA256 d55ec8ebbf308993bbb517f0281fe4296c8e9864e43ff51ba5e0b639b840b085, the XMRig miner SHA256 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4, the Monero wallet 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi, and the sextortion Bitcoin wallet 1LK753UYyYXPcUthYTrxgnaGC8qxXN8ZUK. One social-media-referenced report additionally claimed Needle is written in Rust and that a plaintext embedded API key exposed access to 1,932 victims and the operator withdrawal configuration, but the provided content notes that this claim came only from a Reddit post preview rather than the underlying technical report.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Behind the distribution server, we found Needle — a previously undocumented crimeware-as-a-service platform with browser and desktop wallet spoofers covering 8+ blockchains, a stealer, form grabber, clipper, builder system, launcher framework, and Telegram-integrated C2.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueNine of those responded on April 22, 2026 at 02:53 UTC with a <title>Needle</title> SPA and a healthy /api/v2/health endpoint... each deployment is separately compiled, confirming Needle operates a genuine multi-tenant MaaS model.
Credential Access
5 techniquesMITRE ATT&CK Mapping ... Credential Access Input Capture: Web Portal Capture T1056.003 Form Grabber
Bearer-JWT auth on /api/v2/* authenticated endpoints, with the token stored in localStorage["auth_token"] client-side
API key embedded in plain text inside the Rust malware unlocked 1,932 victims and the operator's withdrawal config
Needle Core ... Specifically: Module What It Steals Passwords Saved browser passwords from all profiles
The bundles are the client-side SPA for the Needle operator panel... they render the browser-stealer panel UI.
Collection
3 techniquesMITRE ATT&CK Mapping ... Credential Access Input Capture: Web Portal Capture T1056.003 Form Grabber
Needle Core ... Specifically: Module What It Steals ... Screenshots Desktop screenshots
Needle Core ... Specifically: Module What It Steals ... Clipper Clipboard cryptocurrency address replacement
Command and Control
4 techniquesNine live Needle MaaS customer panels confirmed on TCP 3000, each serving a separately-compiled Vite bundle with a distinct SHA-256 hash.
MITRE ATT&CK Mapping ... Command and Control Application Layer Protocol: Web T1071.001 HTTP C2 to port 80/3000
MITRE ATT&CK Mapping ... Command and Control Web Service: Dead Drop Resolver T1102.001 Telegram bot notifications
The April 20 report focused on one Needle panel — 178.16.54[.]109 — and documented it end-to-end from the Phorpiex/Trik delivery worm through the wallet-drainer capability set, the private Monero mining pool on :6060...
Exfiltration
1 techniqueMITRE ATT&CK Mapping ... Exfiltration Exfiltration Over C2 Channel T1041 Stealer data exfiltration
Impact
2 techniquesThe bundles do not contain the Phorpiex worm, the wallet-drainer stage, or the Monero miner — those are server-issued payloads documented in the original April 20 report.
MITRE ATT&CK Mapping ... Impact Financial Theft T1657 Wallet draining (browser + desktop)
IOCs tracked for this family
40 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-based crypto-stealer with command-and-control functionality; the referenced analysis says an API key embedded in plaintext exposed victim data and the operator's withdrawal configuration.
Needle is described as a multi-tenant malware-as-a-service platform with customer panels. It is delivered via Phorpiex/Trik, processes exfiltrated credentials, wallets, and browser cookies, includes wallet-drainer capability across multiple blockchains, and is associated with a private Monero mining pool.
Needle is a previously undocumented crimeware-as-a-service platform featuring browser and desktop wallet spoofing, credential and browser data theft, form grabbing, clipboard hijacking, screenshot capture, wallet file theft, builder and launcher systems, browser injects, and Telegram-integrated C2 for cryptocurrency theft and broader infostealer operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.