Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Stealerium Infostealer Analysis: Targets & TTPs

Stealerium

Also known as:Stealerium v3.5.2

What is the Stealerium infostealer, and what data does it steal?

Stealerium (also known as Stealerium v3.5.2) is an information-stealing malware family operating under the MaaS model. Stealerium targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens, Wi-Fi profiles and saved passwords via netsh, Windows product key extraction, Desktop and webcam screenshot capture, VPN client configurations and File grabber configurable by extension and folder. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with high attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

Stealerium is an open-source .NET info-stealer first published on GitHub by user kgnfth in April 2022. The project ships as a buildable C# solution rather than a paid MaaS, so anyone can compile a private build and point it at their own Telegram bot, Discord webhook, SMTP relay, or Gofile upload endpoint. Public reporting tracked a surge in Stealerium activity through 2025 and documents the panel-side summary report as opening with the literal *Stealerium - Report: Markdown-bold banner. The v3.5.2 panel revision tags the banner with the build version (*Stealerium v3.5.2 - Report:*) and organises output into emoji-prefixed *Hardware:* / *Network:* / *Domains info:* / *Browsers:* / *Software:* / *Device:* / *Installation:* / *File Grabber:* sections.

Stealerium is the upstream family for several documented forks: Phantom Stealer (sold as MaaS), Warp Stealer, and StealeriumPy (distributed via ClickFix). The forks rebrand the banner while keeping the underlying data-collection layout, so analysts triaging logs should check the banner literal first to disambiguate.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
st********	Telegram	High

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`fea2678...`	4	High

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1Date: <value>2System: <value>3Username: <value>4CompName: <value>5Language: <value>6Antivirus: <value>7 8💻 *Hardware:<value>9CPU: <value>10GPU: <value>11RAM: <value>12Power: <value>13Screen: <value>14Webcams count: <value>15 16📡 *Network:<value>17Gateway IP: <value>18Internal IP: <value>19External IP: <value>20 21💸 *Domains info:<value>22 23🌐 *Browsers:<value>24   ∟ 📂 AutoFill: <value>25   ∟ ⏳ History: <value>26 27🗃 *Software:<value>28 29🧭 *Device:<value>30 31🦠 *Installation:<value>32 33📄 *File Grabber:<value>34   ∟ 📂 Documents: <value>35 36🔐 Archive password is: <value>