en
X-FILESDeerStealerX-Files StealerXFiles (also known as X-FILES, DeerStealer and X-Files Stealer) is an information-stealing malware family. XFiles targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens and VPN, FTP, RDP client configs. As of 23/10/2026, CyStack's research records 2 variants, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
X-FILES (XFiles / DeerStealer) is a long-running C#-written infostealer first observed on Russian hacker forums in March 2021. Later evolutions (2024+) are sold under the rebranded name DeerStealer by the same actor on dark-web forums and Telegram with a tiered subscription model. Targets Chromium and Gecko browsers, 80+ browser-based crypto wallet extensions, plus VPN, FTP, RDP, and messenger client data.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
2 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
696f8d4... | 95 | High |
7b67103... | 74,244 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Operation ID: <value> IP: <value>Country: <value>Operating System: <value>Username: <value>Hardware ID: <value>CPU (Processor): <value>GPU (Display Devices): <value>RAM (Memory):Screens: <value>Desktop Screenshot Taken: <value> ]Processed parts: [ Total Time to process: <value> Wallets: <value> Ftp: <value> Games: <value> Vpn: <value> Messengers: <value> GeckoBrowsers: <value> Vnc: <value> ChromiumBrowsers: <value> RemoteAdminControl: <value> Hardware: <value> EmailClients: <value>]
