Meduza

Meduza Stealer is a Windows information-stealing malware family that emerged in 2023 and is marketed in the cybercrime ecosystem as a commercial stealer. It is used to harvest credentials and other sensitive data from infected systems and has been observed in criminal operations alongside other commodity malware and ransomware tooling. Meduza has been discussed and traded on underground forums, and reporting indicates it has been adopted by financially motivated threat actors including operators associated with Black Basta and access-broker activity linked to TA569 follow-on infections. Russian authorities have also reportedly detained individuals accused of developing and distributing the malware.

The malware is associated with credential theft from Windows systems, including abuse of Windows Credential Vault access through VaultCLI-related functionality. Reporting also indicates Meduza has successfully bypassed Chrome App-Bound Encryption protections, placing it among a set of modern stealers capable of extracting protected browser data despite recent defensive hardening. Its core role is theft of credentials and other victim information for resale, account takeover, or downstream intrusion activity.

Meduza has been delivered through multiple malware distribution chains rather than a single exclusive vector. Observed delivery includes installation by BunnyLoader and attempted deployment through NetSupport RAT activity in phishing-driven campaigns. It has therefore appeared as a secondary payload in broader intrusion ecosystems that rely on social engineering, loaders, and remote access tooling to establish initial footholds before deploying stealers.

Infrastructure and ecosystem reporting links Meduza to abuse-resistant hosting services used by cybercriminal operators. Aeza Group was publicly tied to infrastructure supporting Meduza operations, alongside other infostealers and ransomware-related services. Meduza has also been referenced in threat-hunting and infrastructure-discovery work focused on criminal panels and command-and-control exposure.

Meduza is best characterized as a commodity infostealer used in financially motivated cybercrime. Its significance lies less in destructive capability than in efficient collection of credentials and browser-resident secrets, its integration into loader and phishing ecosystems, and its adoption by established criminal actors seeking scalable access, fraud enablement, and post-compromise monetization.