A brief look at all things infostealers for the week 33, 2025 (11.08.2025–17.08.2025). Got access to the “restored” XSS forum and checked if there were any updates in infostealers that are new/missed by me. Grabbed some numbers from marketplaces and some interesting news/articles.
Note: All the screenshots are taken from the XSS forum, unless otherwise stated.
Note: The update posts are copy-pasted as is (and machine-translated with DeepL.com if post wasn’t available in English, possibly with some minor edits by me).
Infostealer Updates
AURA Stealer
Comprehensive update
- Added log filtering by the “Only with wallets” option
- Fixed bug with incorrect decryption of strings in the loader module
- Fixed collection of very long passwords
- Added additional protection against cutting/patching startup checks in the CIS
- Added AntiDebug and AntiSandbox methods
- Cleaning, remorphing the build (v1.2.0)
MonsterV2
[+] Added the ability to export Cookies in JSON format in the stealer panel
[=] Updated library versions in the panel
[=] Updated library versions in the daemon
[=] Fixed typos and errors in some error messages
[!] Rebuild not required!
Marketplace Updates
This section provides some numbers taken from the marketplaces, which include numbers of victims based on stealers, top 5 countries, the victim numbers in the countries of the Nordic region. In addition, see the CryptPad spreadsheet for all more broad numbers.
Marketplace Updates Spreadsheet
Russian Market
Stealers by number of victims
| Stealer name | Number of victims |
|---|---|
| Lumma | 6,852,213 |
| Vidar | 516,637 |
| RisePro | 145,580 |
| StealC | 732,336 |
| RedLine | 192,217 |
| Acreed | 400,748 |
| Racoon | 5,096 |
| Rhadamanthys | 77,554 |
Top 5 countries by number of victims
| Country | Number of victims |
|---|---|
| India | 1,024,765 |
| Brazil | 656,099 |
| Indonesia | 508,368 |
| Egypt | 440,269 |
| Pakistan | 380,608 |
Nordic region countries
| Country | Number of victims |
|---|---|
| Sweden | 17,675 |
| Denmark | 9,628 |
| Norway | 7,792 |
| Finland | 6,251 |
| Iceland | 901 |
| Greenland | 136 |
| Faroe | 89 |
| Åland | 21 |
Exodus Market
Stealers by number of victims
| Stealer name | Number of victims |
|---|---|
| Lumma | 474,404 |
| Rhadamanthys | 107,834 |
| RedLine | 35,141 |
| StealC | 25,693 |
| Vidar | 10,533 |
Top 5 countries by number of victims
| Country | Number of victims |
|---|---|
| India | 71,659 |
| Brazil | 50,243 |
| Indonesia | 37,098 |
| USA | 28,878 |
| Philippines | 24,687 |
Nordic region countries
| Country | Number of victims |
|---|---|
| Sweden | 1,909 |
| Denmark | 1,049 |
| Norway | 822 |
| Finland | 615 |
| Iceland | 85 |
Articles/News
Infostealer targets Russian crypto developers
- https://getsafety.com/blog-posts/infostealer-targets-russian-crypto-developers