Happy New Year!
A brief look at all things infostealers for the week 2, 2026 (05.01.2026 –11.01.2026). Updates in AID_Stealer, MioLab and Santa stealers. Grabbed some numbers from marketplaces and few interesting news/articles for you to read.
Infostealer Updates
AID_Stealer
UPDATE
https[://]imgur[.]com/a/tortSuk
1) Several new methods have been added for collecting Steam.
2) A new lightweight “V2” stub has been written (supports running in memory). However, you can also choose to use the old stub.
3) The panel now automatically saves some settings.
4) VM and sandbox detection has been expanded.
5) Clipper pinning has been improved.
6) ABE decrypt has been updated (V2 stub).
Screenshot taken from BHF forum
MioLab Stealer
Hello everyone, I hope you had a great New Year’s holiday!
A few updates.
1) We added proxies—a dedicated server for tapping that increases conversion rates significantly.
One proxy costs $50.
2) The API for commands is now included in the subscription price.
3) Generation of build statistics for conversion tracking.
4) Customization of taps (notifications) for each build.
We hope to finish work on the Safari collection and decryption of notes this week, as well as release a reverse shell for beta testing.
We have decided to keep the price the same until the major update is released, so if you haven’t had a chance yet, this is your last chance.
For those who have already purchased and plan to renew, the price is fixed and will not increase (if you have correspondence/old login from the panel).
$750 monthly subscription
$500 one-time payment for Ledger & Trezor modules
Screenshot from XSS forum
Santa Stealer
SantaStealerUpdate!
• 8 New Features · 4 Improvements · 3 Bug Fixes –(Only notable updates included)
——— NEW FEATURES ———
The SantaStealer Clipper module has been completely rewritten, the module monitors the clipboard for a TRON, Litecoin, Bitcoin, Monero, Solana, Ripple, Dogecoin or EVM based address, and replaces it with a different address. The Clipper is added to startup and works offline.
(EVM based coins include Ethereum, BNB, Cardano, Avalanche and more)1.1 – Complete rewrite of the crypto clipper module, supports dozens of coins including TRX, LTC, BTC, XMR, SOL, XRP, DOGE & EVM based coins such as ETH, BNB, ADA, AVAX. (Premium Plan Only)
1.2 – Added ‘Applications’ & ‘Wallets’ columns to the Logs tab on the Web Panel
1.3 – Improved the design of ‘Traffic’ tab
1.4 – Improved the design of ‘My Builds’ tab
1.5 – Build tab option “I will use my own encryptor” to disable encryption and antiVM making the build compatible with 3rd party encryptors
1.6 – Builds are put inside a password protected ZIP archive. When downloaded you will receive a .ZIP archive containing the .EXE
1.7 – Archive containing stealer has a README.txt with information for using the stealer.
1.8 – Added ability to configure the watermark placed at the top of .TXT files in logs
——— IMRPVEMENTS ———
2.1 – Stub cleaned
2.2 – Modules execute gradually instead of all at once to prevent CPU spikes
2.3 – Data is sent over HTTPS instead of HTTP
2.4 – Windows license is now extracted without cscript, there are no additional other processes now.
——— FIXES ———
3.1 – Fixed some compatibility issues when encrypting the file
3.2 – Fixed issue with payments via NowPayments not confirming until API is restarted
3.2 – Fixed issue with System.txt not being in logs
——— TODO ———
4.1 – Add ability to; Sign Payload, Add custom version details and set payload icon.
4.2 – Ability to configure and add custom wallet extension ID’s
4.3 – Option to pump payload size (MB)
— Basic – $200/month
— Premium – $300/month
— Lifetime (Premium) – $1000/lifetime
— You can access the Santa Stealer WebPanel via stealer.su — generate an account and purchase a plan in less than 1 minute.
Screenshot taken from Santa Stealer’s Telegram channel
Marketplace Updates
This section provides some numbers taken from the marketplaces, which include numbers of victims based on stealers, top 5 countries, the victim numbers in the countries of the Nordic region. In addition, see the CryptPad spreadsheet for all more broad numbers.
Marketplace Updates Spreadsheet 2026
The below spreadsheet contains meaningless numbers taken in 2025:
Marketplace Updates Spreadsheet 2025
Russian Market
Stealers by number of victims
| Stealer name | Number of victims |
|---|---|
| Lumma | 7,012,529 |
| Vidar | 920,789 |
| Acreed | 842,443 |
| StealC | 806,378 |
| Rhadamanthys | 521,817 |
| RedLine | 192,112 |
| RisePro | 145,528 |
| Raccoon | 5,076 |
Top 5 countries by number of victims
| Country | Number of victims |
|---|---|
| India | 1,211,207 |
| Brazil | 748,796 |
| Indonesia | 569,469 |
| Egypt | 490,303 |
| Pakistan | 417,536 |
Nordic region countries
| Country | Number of victims |
|---|---|
| Sweden | 23,084 |
| Denmark | 12,655 |
| Norway | 10,389 |
| Finland | 8,505 |
| Iceland | 1,144 |
| Greenland | 157 |
| Faroe | 111 |
| Åland | 24 |
Exodus Market
Stealers by number of victims
| Stealer name | Number of victims |
|---|---|
| StealC | 9,574 |
| Vidar | 8,446 |
| Lumma | 6,646 |
| Rhadamanthys | 6,414 |
| RedLine | 3 |
Top 5 countries by number of victims
| Country | Number of victims |
|---|---|
| India | 4,199 |
| Brazil | 2,199 |
| Turkey | 1,805 |
| USA | 1,750 |
| Bangladesh | 1,711 |
Nordic region countries
| Country | Number of victims |
|---|---|
| Sweden | 94 |
| Norway | 46 |
| Denmark | 46 |
| Finland | 36 |
| Iceland | 5 |
Articles/News
VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion
- https://unit42.paloaltonetworks.com/vvs-stealer/
- https://mp.weixin.qq.com/s/g6Jp46nUANJj6bTOGNTrug