Pentagon Stealer

Pentagon Stealer is a malware family identified in 2025 and described in the provided reporting as an Android banking malware variant. ANY.RUN reported it among notable threat discoveries in 2025 alongside Salvador Stealer, and separate reporting also listed it as one of three new information stealer malware families detected in the wild. It was first discovered in March 2025. The malware has a Golang-based implementation, and a Python variant of the same stealer had been observed at least a year earlier, distributed through fake Python packages uploaded to the PyPI repository. Based on the available content, high-confidence characteristics are that it is associated with Android targeting, banking-malware behavior, and stealer functionality, with observed propagation via malicious PyPI packages for the Python variant. No specific threat actor attribution, victim industry focus, or concrete indicators of compromise are provided in the content.