Predator The Thief

Also known as:Predator StealerPredatorTheThiefwin.predator

What is the Predator The Thief infostealer, and what data does it steal?

Predator The Thief (also known as Predator Stealer, PredatorTheThief and win.predator) is an information-stealing malware family. Predator The Thief targets browser credentials, cryptocurrency wallets, Steam, Telegram, Discord, FileZilla, WinFTP client credentials (dedicated tallies in the log), System fingerprint (HWID, OS version, CPU, GPU, RAM, screen resolution, machine name, keyboard layouts, system locale), Geolocation (City, Country, Coordinates, IP, Timezone, Zip code) resolved from the harvest-time public IP, Installed applications inventory (numbered ``Installed applications:`` list), Clipboard contents at grab time and Startup / persistence path of the harvester payload. As of 11/10/2026, CyStack's research records 2 distribution channels, with high attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

Predator The Thief is a C/C++ information stealer first advertised in July 2018 on Russian-language forums by an actor known as Alexuiop1337 (later also Kongress_nlt). Sold under a paid model through the Telegram channel t.me/sett9 (v3.x paid channel) and t.me/PredatorSoftwareChannel (update notes). Priced around USD 30 on Russian-speaking forums, positioning it as a low-cost commodity stealer.

Grabs browser passwords, cookies, autofill data, and saved forms; crypto wallets; Steam, Telegram, Discord, FileZilla, and WinFTP client credentials; the current clipboard; and system fingerprint (HWID, OS version, CPU / GPU / RAM / resolution). Later builds add webcam photo capture and clipboard cryptocurrency-address swapping. Distinguishing on-disk artifact is the Information.txt log with an ASCII-art PREDATOR banner and a dash-fenced | Developed by Alexuiop1337 | / | Buy Predator at t.me/sett9 | credit block above the tally section.

Operator panels & distribution channels

2 distinct distribution channels recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

—	Telegram	High
—	Telegram	High