Oski Stealer is a Windows information-stealing malware family associated with credential theft and collection of other sensitive host data. It has been observed extracting browser credentials, cryptocurrency wallet-related data, screenshots, and system information, and it has shown behavioral overlap with closely related stealer families such as Arkei, Vidar, and possibly Mars, which can complicate precise family attribution in some cases. Reporting has noted code-sharing or lineage links between Oski and other commodity stealers in the Arkei/Vidar ecosystem.
Oski has appeared in multi-stage crimeware delivery chains alongside loaders, banking trojans, and post-exploitation tooling. Documented campaigns delivered it through phishing emails that impersonated copyright complaints and linked victims to malicious documents hosted on legitimate file-sharing services; those documents used macros to retrieve and execute follow-on payloads. Oski has also been distributed through fake coronavirus-themed landing pages reached via malicious router-based traffic redirection, as well as through cracked-software or keygen lures used to deliver stealer payloads.
On infected systems, Oski is associated with browser data theft and exfiltration of collected information in archive form. Observed artifacts linked to Oski-style activity include stolen browser history, screenshots, and host profiling data. Related stealer samples in this cluster have also downloaded browser-support libraries commonly used to access protected data from Firefox and Chromium-derived browsers. Anti-analysis behavior associated with Oski-era stealer variants includes checks for Windows Defender emulator artifacts, a technique also seen across several other commodity stealers.
Oski has circulated in underground markets, including cracked builds offered on cybercrime forums, which lowered the barrier to entry for financially motivated actors. Its use aligns with broad credential-harvesting and information-theft operations rather than narrowly targeted espionage, though campaigns delivering it have affected users across multiple countries and sectors.
