Stealerium

Stealerium is an open-source .NET/C# information stealer first noted in 2022 and publicly available on GitHub, where it was described as a stealer, clipper, and keylogger. It is widely referenced as an infostealer family and as the codebase underlying later forks and variants, including Phantom Stealer/PhantomStealer, with multiple reports noting significant code overlap and family lineage.

High-confidence capabilities described in the source material include theft of browser credentials, browser cookies, session tokens, cryptocurrency wallet data, and general sensitive information from compromised Windows systems. Stealerium can exfiltrate stolen data through multiple channels, especially Discord webhooks, and reporting also associates the broader family with SMTP, Telegram, FTP, and other exfiltration paths in derived variants. The malware also includes clipper functionality to replace copied cryptocurrency wallet addresses and keylogging functionality.

A notable feature documented by Proofpoint is NSFW-triggered surveillance behavior: Stealerium can be configured to monitor open browser tabs for keywords such as "sex" or "porn" and, when triggered, capture a desktop screenshot and a webcam image. Reporting states newer modules were added specifically to support sextortion-style abuse and blackmail.

Stealerium has been delivered in phishing and social-engineering campaigns, including ClickFix-style chains and campaigns using malicious SVG files to trigger PowerShell execution. It has also appeared in multilingual phishing activity, including Italian-language campaigns. The malware has been observed or reported in campaigns targeting enterprise victims and sectors including logistics, industrial, manufacturing, technology, retail, construction, and IT, though some of those campaigns involved Stealerium-derived Phantom variants rather than base Stealerium itself.

The content also notes operational abuse of Discord infrastructure: Stealerium has used Discord webhooks to steal credentials, browser cookies, and cryptocurrency wallets, and broader reporting cited it among malware families abusing Discord services for delivery or exfiltration.

Relevant high-confidence indicators and associations mentioned in the content include the GitHub handle "witchfindertr" as the public developer identity for the released codebase, Discord webhook-based exfiltration, and strong code/family overlap with Phantom Stealer/PhantomStealer. The content does not provide a canonical malware hash for base Stealerium itself.