🍪 Infostealer Tracker

A fork of the older Arkei stealer, in circulation since 2018. Trend Micro reported it as one of the main replacements chosen by Lumma customers in late 2025.

Gen Digital attributes Remus to the Lumma lineage as a 64-bit variant, citing near-identical obfuscation and browser encryption bypass code; it resolves its command servers through Ethereum smart contracts. The developer denies it is a Lumma rebrand.

Sold on Telegram for 1,000 US dollars a month from April 2023. Sophos says it accounted for almost 40 percent of its macOS protection updates in 2025.

Formbook went on sale in February 2016 and was rebranded as XLoader in 2020, when it was sold only as a hosted service and gained a macOS build.

Written in Go and sold by Russian-speaking operators linked to NyashTeam. It combines data theft with remote control and live webcam and microphone streaming.

A .NET keylogger first seen in late 2014 that exfiltrates over SMTP, FTP or Telegram. Unit 42 tracks OriginLogger as its direct successor.

Sold by a developer known as Plymouth since January 2023, with version 2 released in March 2025. The June 2026 action against StealC, Amadey and SocGholish recovered 27 million compromised data sets.

Part of the Pure family of tools from the developer PureCoder and usually delivered by the PureCrypter loader. Recent campaigns targeted healthcare, government, hospitality and education.

Microsoft counted over 394,000 infected Windows computers between March and May 2025, and the FBI identified at least 1.7 million instances of Lumma stealing data. Gen Digital attributes the 2026 Remus stealer to the same code lineage.

Began as Mac.c in April 2025, was sold and renamed MacSync a month later, and added a Go-based backdoor.

Hides its command server behind dead-drop pages on Steam, Telegraph and Google Docs. Proofpoint identified Amatera as a rebranded, improved version.

First advertised on Russian-language forums in early 2020 and long one of the most widespread stealers. ESET found over 1,000 IP addresses hosting RedLine panels and concluded that RedLine and META share a creator.

Launched in March 2022 as a RedLine clone that claimed the same code and panel. ESET concluded that RedLine and META share a creator.

Leased for about 200 US dollars a month according to the DOJ. Sokolovsky pleaded guilty and was sentenced to 60 months in US federal prison in December 2024.

A modular stealer sold since September 2022 that builds on its authors' earlier Hidden Bee project. Europol said its main suspect had access to over 100,000 victim crypto wallets.

Flashpoint assessed it as very likely a clone of Vidar when it surfaced in December 2022; its logs were sold on the Russian Market shop.

Check Point found a build that encrypted its strings with the same algorithm Apple uses in XProtect, and those samples went undetected on VirusTotal for over two months.

Rebranded from RodStealer in June 2024 by the developer Rodrigo4 and shares much of its code with Atomic Stealer.

Google estimated it infected about 670,000 computers in the year before its lawsuit, spread through tampered versions of software such as Google Earth Pro and Chrome.

A rebrand of ACR Stealer whose panel first surfaced in December 2024. It talks to its servers through low-level Windows sockets to avoid hooked network APIs.

The relaunch of Poseidon under a new owner, adding anti-sandbox checks and persistence that Atomic Stealer later copied.