Loading story…
Threat researchers reported a new Python-based Windows information-stealing malware dubbed SolyxImmortal that emphasizes stealth and long-term persistence over destructive actions. The implant is described as a “monolithic” package (not modular), delivered as a legitimate-looking Python script (e.g., Lethalcompany.py), and runs quietly in the background to harvest sensitive data including credentials, documents, keystrokes, and screenshots.
SolyxImmortal’s command-and-control and exfiltration model relies on Discord webhooks, abusing trusted HTTPS traffic to blend in and reduce network-based detection. Reporting attributes the analysis to CYFIRMA, noting that C2 parameters are hardcoded and that operators can receive real-time notifications (including via a hardcoded Discord user ID) for high-value events; separate webhooks may be used for different data types (e.g., logs/files vs. screenshots). The malware targets browser-stored data (including Chromium-based browsers such as Chrome, Edge, Brave, and Opera GX) and focuses on single-host surveillance rather than lateral movement.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
By January 20, 2026, CYFIRMA had analyzed SolyxImmortal's behavior, including persistence via a hidden AppData copy and Registry Run key, credential theft from Chromium-based browsers, keylogging, screenshot capture, document harvesting, and exfiltration through hardcoded Discord webhooks. The researchers assessed it as a commodity or mid-tier threat, with medium-confidence indications of a Turkish-speaking author.
CYFIRMA reported that the Python-based Windows infostealer SolyxImmortal emerged in January 2026 and was being circulated in underground and Telegram-linked channels as a stealth-focused surveillance tool.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
A wave of sophisticated Python-based malware and stealer campaigns has been observed, leveraging advanced evasion techniques and targeting a wide range of platforms. Notable threats include a Python malware that hides within PNG-disguised RAR files and injects payloads into legitimate executables, as well as the Xillen Stealer v4, which employs polymorphic evasion to target over 100 browsers and 70 cryptocurrency wallets, including DevOps environments. Other campaigns involve the Eternidade Stealer, a Python WhatsApp worm using IMAP email for covert command and control and deploying overlays to target Brazilian banking users, and a multi-layer Python RAT distributed via PyPI typosquatting, which bypasses scanners using XOR encryption. Additionally, attackers are exploiting messaging platforms such as WhatsApp with sophisticated worms that hijack sessions and deploy banking trojans like Astaroth. Another campaign involves a trojanized VPN installer that delivers the NKNShell backdoor, utilizing P2P blockchain and MQTT protocols for covert C2 communications. These incidents highlight the increasing complexity and diversity of Python-based malware, the use of novel distribution and evasion tactics, and the growing risk to both individual users and enterprise environments across multiple vectors, including messaging apps, software supply chains, and browser extensions.
Jun 29, 2026
Researchers detailed two separate malware operations that rely on stealth and in-memory execution to steal credentials and maintain remote access. One campaign targeted Roblox exploit users with a trojanized executor branded as **Yuta/Solara**, presenting a polished .NET WPF interface with AI-themed features while silently deploying a PyInstaller-packed Python 3.12 stealer linked to the Glove Stealer family. The malware harvested browser credentials, Roblox cookies, developer secrets, MetaMask vaults, Discord tokens, and Google account artifacts, while using AMSI and ETW patching, Windows Defender tampering, AppLocker evasion, persistence mechanisms, and Discord webhooks for exfiltration.
Jun 29, 2026