Alleged Sale of Custom Stealer Malware on XSS Forum

⚠ Disclaimer

This report includes actual screenshots and/or text that may include unredacted personally identifiable information (PII) gathered from publicly available sources. The sensitive information presented within this report is intended solely for cybersecurity awareness and threat intelligence purposes. Dark Web Informer explicitly condemns unauthorized access, distribution, or misuse of the personal data displayed or referenced here. Users must treat exposed data responsibly and ethically.

📌 Overview

A threat actor using the alias cone has posted a listing on an underground forum offering a custom stealer malware for $120 per month. Written in C++ with a compact size of approximately 700 KB, the malware collects a variety of sensitive data including browser information, saved credentials, cookies, file paths, process data, and Chromium browser extensions. All stolen data is uploaded to the seller’s own server, which is periodically wiped. Users are required to deploy the malware on their own infrastructure, and use within Russia, CIS countries, and former USSR nations is explicitly forbidden.

📊 Key Details