en
Meduza StealerMeduzaStealerMeduza (also known as Meduza Stealer and MeduzaStealer) is an information-stealing malware family operating under the MaaS model. Meduza targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens, Password managers (~19 supported per public reporting) and System hardware and locale inventory. As of 11/10/2026, CyStack's research records 2 variants, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Meduza Stealer is a Windows .NET info-stealer first publicly
documented in June 2023. It is sold as a malware-as-a-service
offering on Russian-language hacking forums and is
geo-excluded against several CIS targets (Russia, Kazakhstan,
Belarus) per public write-ups. The family is tracked under the
canonical literals win.meduza and Meduza in public malware
databases, with corroborating public analysis. CERT-UA has
referenced Meduza in UAC-0050 phishing waves against Ukraine
and Poland.
The harvested log opens with a seven-line ASCII-art banner
spelling MEDUZA using Unicode block characters inside a
*-bordered frame, followed by a flat Key: Value body. The
field set is HWID, Log Date, Build Name, Country Code,
User Name, Computer Name, Operation System (panel-side
typo, sic), Time Zone (bracket-wrapped offset joined with
the verbose name), Screen Resolution, CPU (name plus
padded comma plus logical-core count), GPU, RAM
(dot-decimal GB with four-decimal precision), IP, and
Execute Path. The Log Date value is DD-MM-YYYY HH:MM:SS
European format with a comma separating date and time.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
2 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
3c577d4... | 80 | High |
d914ed9... | 1 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
IP: <value>Execute Path: <value>Build Name: <value>User Name: <value>Computer Name: <value>CPU: <value>GPU: <value>GPU: <value>Operation System: <value>Country ISO2: <value>Elevated: <value>Screen Resolution: <value>Date: <value> Enviromental Variables: ALLUSERSPROFILE=<value>APPDATA=<value>CommonProgramFiles=<value>CommonProgramFiles(x86)=<value>CommonProgramW6432=<value>COMPUTERNAME=<value>ComSpec=<value>configsetroot=<value>DriverData=<value>HOMEDRIVE=<value>IntelliJ IDEA Community Edition=<value>INTEL_DEV_REDIST=<value>LOCALAPPDATA=<value>LOGONSERVER=<value>MIC_LD_LIBRARY_PATH=<value>NUMBER_OF_PROCESSORS=<value>OneDrive=<value>OneDriveConsumer=<value>OS=<value>Path=<value>PATHEXT=<value>PROCESSOR_ARCHITECTURE=<value>PROCESSOR_IDENTIFIER=<value>PROCESSOR_LEVEL=<value>PROCESSOR_REVISION=<value>ProgramData=<value>ProgramFiles=<value>ProgramFiles(x86)=<value>ProgramW6432=<value>PSModulePath=<value>PUBLIC=<value>redshift_LICENSE=<value>SystemDrive=<value>SystemRoot=<value>TEMP=<value>TMP=<value>USERDOMAIN=<value>USERDOMAIN_ROAMINGPROFILE=<value>USERNAME=<value>USERPROFILE=<value>windir=<value>ZES_ENABLE_SYSMAN=<value>
