Bee Stealer is a commercially-sold malware-as-a-service
infostealer first publicly documented by Flashpoint in the
"Infostealers to Watch in 2025" brief. Public reporting
places the June 2025 debut at roughly $300 per month on a
centralized-panel model that does not permit customers to
self-host, with a stated feature list covering credential /
cookie / card / cryptocurrency wallet theft plus
attacker-configurable file grabbing. Downstream aggregator
traffic markets (for example the @FATETRAFFIC Telegram
MIX packs) resell Bee logs alongside other families.
The panel writes a per-victim UserInfo.txt opening with
an ASCII-art bee mascot rendered from parenthesis and
backslash glyphs and a Bee stealer self-brand banner line
in lowercase, separated from the device block by a
fixed-width 28-hyphen dash rule. The device block uses a
hyphenated lowercase key vocabulary (os, time-zone,
local-date, language, computer-name, netbios,
hostname, user-name, domain, cpu-cores, cpu,
ram-total, display-x, display-y, gpu) in flat plain
text rather than the YAML block layout Remus uses. A
trailing block carries capitalised Ip and Country keys
and the report closes with a Procces riped: True boolean
that surfaces the panel writer typo verbatim across observed
samples.
