Cyber Stealer

A sophisticated new infostealer and botnet named “Cyber Stealer” was discovered by eSentire’s Threat Response Unit (TRU) in May 2025. This multi-purpose malware combines advanced information stealing capabilities with botnet functionality, creating a versatile attack platform. Cyber Stealer operates on a tiered subscription model with three distinct packages:

———————————————————————————————————————————————————————————–

The malware’s information stealing components target a comprehensive range of applications and services, including:

• Web browsers and their stored credentials

• Cryptocurrency wallets

• Communication platforms

• Gaming applications

• Development tools

• Email services

• Cloud storage platforms

• Password managers

• VPN clients

———————————————————————————————————————————————————————————–

CyberStealer extracts stored passwords, cookies, and autofill data from browsers, captures keystrokes, collects cryptocurrency wallet files, and records system details. The harvested information is then transmitted to a command-and-control server controlled by attackers.

Beyond data theft, Cyber Stealer’s botnet capabilities enable threat actors to:

• Download/execute additional malware

• Conduct keylogging attacks to harvest victim keystrokes

• Launch DDoS attacks

• Mine cryptocurrency

• Establish reverse proxies

• Access remote shells

• Replace victims’ clipboard with threat actor controlled crypto-currency wallet addresses

———————————————————————————————————————————————————————————–

Key Features

A comprehensive list of key features marketed by the threat actor are included below.