Stealerium

Stealerium is an open-source .NET information stealer written in C# that emerged in 2022 and has been widely reused, modified, and operationalized in criminal campaigns. It is best known as an infostealer with additional keylogging and cryptocurrency clipper functionality, and it has served as the codebase foundation for related malware such as Phantom Stealer and Enigma Stealer. Security reporting has repeatedly linked Stealerium-family malware to financially motivated activity, including phishing and ClickFix-style social-engineering campaigns, as well as broader commodity malware ecosystems targeting enterprise users and individuals.

Core Stealerium functionality includes theft of browser-stored credentials, cookies, session tokens, cryptocurrency wallet data, and other sensitive application data from compromised Windows systems. Reported variants and forks have also collected screenshots, clipboard contents, VPN and Wi-Fi information, messaging and email application data, and general host profiling information. Stealerium additionally supports keylogging and clipper behavior, enabling interception of keystrokes and replacement of copied cryptocurrency wallet addresses. Exfiltration has been observed through multiple channels, including Discord webhooks, Telegram, SMTP, FTP, and related mechanisms depending on the build and operator configuration.

A notable feature associated with Stealerium is NSFW-triggered surveillance intended to support sextortion or blackmail. When configured to detect adult-themed keywords in an active browser tab, the malware can capture a desktop screenshot and a webcam image. This capability distinguishes it from many commodity stealers that focus primarily on credential and wallet theft.

Stealerium has frequently appeared in phishing-delivered infections and in social-engineering chains that rely on user execution rather than software exploitation. Observed delivery patterns include malicious archives, script-based droppers, PowerShell loaders, and ClickFix-style lures. Because the project is openly available, many campaigns involve customized forks that add obfuscation, process injection, persistence, anti-analysis, or bespoke loaders while retaining Stealerium’s theft modules and configuration structure.

The malware primarily targets Windows systems. Its open-source availability and modular design have lowered the barrier to entry for threat actors, making it a recurring component in commodity credential-theft operations and a common ancestor for more heavily weaponized infostealer variants.