en
Erbium StealerErbium (also known as Erbium Stealer) is an information-stealing malware family operating under the MaaS model. Erbium targets browser credentials, cryptocurrency wallets, 2FA codes, FileZilla / VPN credentials, Card numbers stored by browsers and Game client sessions and small file grabber. As of 11/10/2026, CyStack's research records 2 distribution channels, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Erbium Stealer is a C# / .NET Malware-as-a-Service info-stealer that surfaced in mid-2022 on Russian-speaking crime
forums. The first public report of the family landed in July
2022; a follow-on technical writeup covered the DLL loader and
the panel dashboard at panel.erbium.ml. Pricing tiers
observed on the operator channel run from $9/week at launch
up to $100/month and $1000/year. Initial distribution
campaigns rode fake game cracks and cheat installers per
contemporaneous public coverage.
The panel writes Information.txt with an ERBIUM ASCII
banner, two t.me/erbium_* operator-channel URLs (Developer +
Updates), and five bracketed sections in fixed order:
[BUILD], [PC INFO], [LOG INFO], [CLIPBOARD],
[ANTIVIRUSES]. Field lines are tab-indented with a mixed
hyphen / colon separator (hyphen for identity and count
fields, colon for the hardware inventory inside [PC INFO]).
HardwareID is a 64-character uppercase hex string; the
archive victim folder is named after the same identifier.
2 distinct distribution channels recorded for this malware
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Panel name | Distribution channel | Confidence |
|---|---|---|
| — | Telegram | High |
| — | Telegram | High |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
