Jun 3, 2026
C2 Hosts: 3
MASS Logger
MassLogger is a .NET credential stealer. It starts with a launcher that uses simple anti-debugging techniques which can be easily bypassed when identified. This first stage loader eventually XOR-decrypts the second stage assembly which then decrypts, loads and executes the final MassLogger payload.
C2 Infrastructure
Hosting/VPS 67%
Business 17%
Unknown 17%
Last 7 days
Jun 2, 2026
C2 Hosts: 2
May 29, 2026
C2 Hosts: 1
| Date | C2 Hosts |
|---|---|
| Jun 3, 2026 | 3 |
| Jun 2, 2026 | 2 |
| May 29, 2026 | 1 |
Further Reading
A year of Fajan evolution and Bloomberg themed campaigns opens in a new tab
By Vanja Svajcer. News summary * Some malware campaigns are designed to spread malware to as many people as possible — while some others carefully choose their targets. Cisco Talos recently di...
blog.talosintelligence.com
Diving into MassLogger opens in a new tab
Logging is not a bad thing per se. But there are some types of logging that you definitely would not want. We have taken a look at a current example.
gdatasoftware.com
njRAT runs MassLogger opens in a new tab
njRAT is a remote access trojan that has been around for more than 10 years and still remains one of the most popular RATs among criminal threat actors. This blog post demonstrates how NetworkMiner...
netresec.com
MassLogger: An Emerging Spyware and Keylogger | Seqrite opens in a new tab
We have been dealing with a new spyware for the past two months, named MassLogger. This advanced keylogger and spyware are distributed via MalSpam attachments and has more features than other prese...
seqrite.com
Masslogger Fileless Variant: Spreading via .VBE, Hiding in Registry – A Deep Dive opens in a new tab
Deep dive into Masslogger's fileless tactics: spreading via .VBE and storing its malicious payload entirely in the Windows Registry. Understand its multi-stage attack and methods for stealing passw...
seqrite.com