Last seven days
- First activity
- Aug 27, 2026
- Last activity
- Aug 27, 2026
- Feed role
- C2
- Host form
- 1 IP / 0 hostnames
KPOT Stealer
KPOT Stealer is a Windows information-stealing malware family sold in cybercrime markets and used in criminal delivery campaigns since at least 2018.
Profile source: Mallory opens in a new tabKPOT Stealer
Family profile
KPOT Stealer is a Windows information-stealing malware family sold in cybercrime markets and used in criminal delivery campaigns since at least 2018. It is designed to collect and exfiltrate credentials, cookies, autofill data, account information, and other sensitive artifacts from a broad set of applications, including web browsers, instant messengers, email clients, VPN software, remote access tools, FTP clients, cryptocurrency wallets, and gaming platforms. Documented targets include Chrome, Firefox, Internet Explorer, Outlook, Skype, Telegram, Discord, Steam, Battle.net, WinSCP, FileZilla, RDP-related data, Windows credentials, and multiple cryptocurrency applications and wallets.
Technically, KPOT is written in C/C++ and commonly employs packed samples, encrypted strings, and runtime API resolution to hinder analysis. Important strings are stored in encrypted form and decrypted with XOR-based routines at runtime. The malware resolves Windows APIs dynamically by parsing the PEB and hashing export names with a Murmur3-based algorithm, avoiding straightforward static imports. It communicates with command-and-control infrastructure over HTTP, retrieves tasking and configuration data, and exfiltrates collected results in encrypted form. Observed tasking includes theft of browser and application data, screenshot capture, collection of host profiling information, and file theft based on server-supplied grabber rules. Some analyzed variants also perform a geographic check and terminate on systems located in CIS countries.
Observed delivery has included email campaigns, exploit-kit activity, and malicious software download chains. One documented infection chain used a malicious RTF attachment exploiting CVE-2017-11882 to stage a downloader and ultimately deploy KPOT. The malware has also been distributed through compromised websites that replaced legitimate software downloads with trojanized installers. TA578 has been observed delivering KPOT in email-based campaigns alongside other crimeware families. In analyzed cases, some samples lacked a persistence mechanism and instead executed assigned tasks, posted results, and exited.
Capabilities
- Credential Theft
- Exfiltration
- Reconnaissance
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Aug 27
Observed infrastructure
Leading locations
- DE1
Leading providers
- Amazon.com, Inc.1
Infrastructure traits
- Hosting 1
Samples
Recent associated samples
602e6bfee3ec35f5e5558c60ef505a7ce2264c5a2bde49d4d0b20113c353462d Observed Aug 27, 2026Triage
658315611efdbd9e63c0e6c63d003de3ce9d2ac6c831789b67bc7d2b19cd7548 Observed Aug 27, 2026Triage
8cba5f47e8f4bc973ff52ed89f396d35b693acec82a4a3387a720432b0d3a702 Observed Aug 27, 2026Triage
a4cc973ac337531b429b6f4430c98fd227f879200df1afd21c9abcdcf9c9b786 Observed Aug 27, 2026Triage
d58ce24b9093d2cedcffaea6422589fb21283ed11907814e3e74e09cbfa4323e Observed Aug 27, 2026Triage
Reported operators
Threat actors
1 named in public reportingTA578 since May 2020 and uses email campaigns to deliver malware like Ursnif, IcedID, KPOT Stealer, Buer Loader, and BazaLoader
Exploited software
Vulnerabilities linked to KPOT Stealer
1 CVEsMITRE ATT&CK
KPOT Stealer in ATT&CK
25 distinct techniquesTechniques
25 techniques T1005 Data from Local System T1027.002 Software Packing T1140 Deobfuscate/Decode Files or Information T1555 Credentials from Password Stores T1070.004 File Deletion T1027.007 Dynamic API Resolution T1649 Steal or Forge Authentication Certificates T1027 Obfuscated Files or Information T1082 System Information Discovery T1041 Exfiltration Over C2 Channel T1566 Phishing T1189 Drive-by Compromise T1497.001 System Checks T1113 Screen Capture T1620 Reflective Code Loading T1057 Process Discovery T1539 Steal Web Session Cookie T1560 Archive Collected Data T1071.001 Web Protocols T1059.001 PowerShell T1105 Ingress Tool Transfer T1132 Data Encoding T1203 Exploitation for Client Execution T1195 Supply Chain Compromise T1566.001 Spearphishing Attachment
Reporting
Research mentioning KPOT Stealer
Dec 15
Github Web
Malware-analysis-and-Reverse-engineering/kpot2/KPOT.md at main · Dump-GUY/Malware-analysis-and-Reverse-engineering · GitHub
Researchers detailed KPOT v2.0, a commercially sold information-stealing malware strain designed to harvest credentials and sensitive data from browsers, messaging applications, email clients, VPN and RDP software, FTP clients, gaming platforms, and cryptocurrency wallets including Jaxx. The malware was marketed on underground forums at a low price point, making it accessible to a broad range of threat actors, and its targeting of wallet users highlighted the growing overlap between credential theft and cryptocurrency-focused crime. Observed delivery methods included email campaigns and exploit kits, including an RTF lure exploiting CVE-2017-11882 to launch a PowerShell-based loader that retrieved the final payload. Once executed, KPOT used encrypted strings, runtime API resolution, and an encrypted HTTP command-and-control configuration to receive tasks, exfiltrate system and credential data, and steal files matching attacker-defined rules. The analyzed variant notably used in-memory execution and no persistence, terminating after completing assigned tasks, and also checked for victims in CIS countries before exiting without infecting them.
Apr 12
Handlers Diary Full
Reader Analysis: "Dynamic analysis technique to get decrypted KPOT Malware."
May 9
Proofpoint Threat Insight
