Krypton Stealer

The Krypton Stealer is a hacking tool that is being sold on Russian hacking forums in exchange for a payment of Bitcoin or Ethereum. Its authors claim that this is a light-weight info stealer, which packs a lot of features that would render the attacker to collect data from their victims and then wipe out any traces of the stealer’s activity automatically. The price of the product has not been specified, but basic Russian malware like this one usually tend to be rather cheap so that it is expected that many criminals will opt to take advantage of the Krypton Stealer. Unfortunately, if the popularity of this product grows, the data of hundreds of thousands of users around the globe might be put in danger because of it.

The Krypton Stealer is coded in C and C++, and it can run on Windows 7 and above. The project’s authors state that the final payload is small and can be easily obfuscated using popular tools to avoid anti-virus products.

Once the Krypton Stealer is active on a compromised host, it may gather information from popular Web browsers like Google Chrome, Opera, Internet Explorer, Amigo, Sputnik, Maxthon, Vivaldi and others. The stealer is capable of grabbing download details, saved passwords, auto-completion settings, search history and saved credit card data.

The Krypton Stealer also pays special attention to FTP clients and targets FileZilla, FTPNavigator, and TotalCommander by trying to collect login information. In addition to this, it attempts to hijack Telegram sessions, and collect the sessions of popular VPN clients like Proton VPN and Nord VPN. Naturally, just like any modern info stealer, it also will look for saved cryptocurrency wallets and collect the files linked to them – Exodus, Jaxx, Electrum and Ethereum.

The Krypton Stealer’s reports and victims are managed through a control panel that the project authors provide. Their advertisement mentions future updates and adding extra features so that it would not be a surprise if the Krypton Stealer’s customer base continues to grow.

The malware sold on hacking forums is usually of good quality, but it is detectable by anti-virus products easily thanks to the fact that it is public. If you have a reputable and up-to-date anti-malware software suite installed, you are very likely to be protected from the Krypton Stealer and similar threats sufficiently.