Malware

Bichromate

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1204.002Malicious FileEvidence1

T1204.002 Initial Access User Execution: Malicious File Victim runs the WiX installer

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

T1027 Defense Evasion Obfuscated Files or Information XOR-encrypted config, AES-encrypted payload

T1036.005Match Legitimate Resource Name or LocationEvidence1

T1036.005 Defense Evasion Masquerading: Match Legitimate Name "Antonomasia" by "Cyme" + Active@ Password Changer decoy

T1140Deobfuscate/Decode Files or InformationEvidence1

T1140 Defense Evasion Deobfuscate/Decode Files or Information In-memory decryption via CryptoPP

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

T1071.001 Command and Control Application Layer Protocol: Web Protocols HTTPS C2 via Cloudflare

T1573.001Symmetric CryptographyEvidence1

T1573.001 Command and Control Encrypted Channel: Symmetric Cryptography XOR + AES encrypted C2 traffic

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Mar 16, 2026

That Password Manager You Downloaded Is Actually a $3,000/Month Infostealer - Breakglass Intelligence - Breakglass Intelligence

Bichromate is the download/loader component in the bundle. It masquerades as Adobe's CCMNative.dll, decrypts an XOR-obfuscated XML configuration to obtain C2 details, beacons over HTTPS, and decrypts the embedded DeerStealer payload in memory using AES-CBC for fileless execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.