en
Ailurophile StealerAilurophile (also known as Ailurophile Stealer) is an information-stealing malware family. Ailurophile targets browser credentials, cryptocurrency wallets and Generic file grabber driven by configurable keyword and extension lists. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Ailurophile is a subscription-style info-stealer first publicly documented in August 2024. The stub is PHP-coded, packaged into a Windows PE with ExeOutput, and then virtualized with BoxedApp. Operators configure each build through the family's own web panel, which lets them pick the extension list, the folder list, and the filename keyword list that drive the on-victim file grabber. Reports are sent to the Telegram chat configured at build time.
The on-victim staging directory is
%LOCALAPPDATA%\Ailurophile, and the system summary is a flat
Key: Value info.txt whose distinctive fields are Allowed Extensions:, Folders to Search:, PC Type:, and Screen Resolution:.
1 distinct distribution channel recorded for this malware
| Panel name | Distribution channel |
|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Confidence |
|---|
| ho******** | Telegram | High |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
775f61d... | 66 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
IP: <value>Country: <value>Hostname: <value>PC Type: <value>Architecture: <value>File Path: <value>Main Path: <value>Allowed Extensions: <value>Folders to Search: <value>Files: <value>MAC Address: <value>Screen Resolution: <value>Browsers:Chrome Default - version: <value>
