en
Rhadamanthys StealerRhadamanthys (also known as Rhadamanthys Stealer) is an information-stealing malware family. Rhadamanthys targets browser credentials, cryptocurrency wallets, 2FA codes, PDF, Office, and other document grabber and Messenger and email clients. As of 11/10/2026, CyStack's research assesses medium attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Rhadamanthys info-stealer logs (v0.9.x device-fingerprint shape).
Writes a flat systeminfo.txt opening with IP:, Country:
and continuing with a hardware and locale block. Distinguished
from Redline-shape logs by the Wallpaper Hash: and
MachineID: field combination, which Rhadamanthys emits but
Redline never does. Continuously updated through 2025 with
expanded crypto-wallet, browser, and messenger coverage.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
