A brief look at all things infostealers for the week 39, 2025 (22.09.2025–28.09.2025). There were few updates in infostealers. Grabbed some numbers from marketplaces and some interesting news/articles.
Note: The update posts are copy-pasted as is (and machine-translated with DeepL.com if post wasn’t available in English, possibly with some minor edits by me).
Infostealer Updates
MonsterV2
[+] Experimental decryption of app bound encryption of Chromium-based browsers without admin rights is now operational on an ongoing basis
[+] Added a button to clear the cache and restart the panel for more stable and convenient operation in it.
[=] Fixed bugs in experimental cookie decryption
[=] The code in the panel has been optimized and bugs on the settings page have been removed (the page was not rendered correctly in some cases)
[!] Rebuild required!
Screenshot from XSS forum
[+] All major antiviruses have been cleaned, including Windows Defender
[=] Updated Go version to 1.25.1 in panel and daemon
[!] Rebuild required!
Screenshot from XSS forum
VIDAR Stealer
Whoop Whoop️
Unscheduled update for better software performance:
- optimized steam token collection.
- software cleanup.
- replacement of proxy servers.
Screenshot from WWH Club forum
Marketplace Updates
This section provides some numbers taken from the marketplaces, which include numbers of victims based on stealers, top 5 countries, the victim numbers in the countries of the Nordic region. In addition, see the CryptPad spreadsheet for all more broad numbers.
Marketplace Updates Spreadsheet
Russian Market
Stealers by number of victims
| Stealer name | Number of victims |
|---|---|
| Lumma | 6,963,283 |
| Vidar | 551,833 |
| RisePro | 145,552 |
| StealC | 746,459 |
| RedLine | 192,191 |
| Acreed | 523,512 |
| Racoon | 5,088 |
| Rhadamanthys | 215,345 |
Top 5 countries by number of victims
| Country | Number of victims |
|---|---|
| India | 1,080,500 |
| Brazil | 681,786 |
| Indonesia | 527,311 |
| Egypt | 459,420 |
| Pakistan | 394,597 |
Nordic region countries
| Country | Number of victims |
|---|---|
| Sweden | 18,823 |
| Denmark | 10,310 |
| Norway | 8,344 |
| Finland | 6,715 |
| Iceland | 967 |
| Greenland | 138 |
| Faroe | 93 |
| Åland | 21 |
Exodus Market
Stealers by number of victims
| Stealer name | Number of victims |
|---|---|
| Lumma | 474,943 |
| Rhadamanthys | 107,418 |
| RedLine | 35,120 |
| StealC | 26,605 |
| Vidar | 11,496 |
Top 5 countries by number of victims
| Country | Number of victims |
|---|---|
| India | 71,746 |
| Brazil | 50,464 |
| Indonesia | 37,168 |
| USA | 28,883 |
| Philippines | 24,778 |
Nordic region countries
| Country | Number of victims |
|---|---|
| Sweden | 1,914 |
| Denmark | 1,052 |
| Norway | 825 |
| Finland | 611 |
| Iceland | 85 |
Articles/News
Inside Vietnamese Threat Actor Lone None’s Copyright Takedown-Spoofing Campaign
- https://cofense.com/blog/inside-vietnamese-threat-actor-lone-none-s-copyright-takedown-spoofing-campaign
SVG Phishing hits Ukraine with Amatera Stealer, PureMiner
- https://www.fortinet.com/blog/threat-research/svg-phishing-hits-ukraine-with-amatera-stealer-pureminer
Analysis of Acreed, a rising infostealer
- https://www.intrinsec.com/wp-content/uploads/2025/09/TLP-CLEAR-Sept-2025-Acreed-infostealer-EN.pdf