Storm Stealer is a C++ malware-as-a-service infostealer first
publicly documented by Varonis in early 2026 and cross-covered
by Infosecurity Magazine, Hackread, and BleepingComputer. The
panel is marketed as a session-hijacking / server-side
decryption platform aimed at browser cookies, saved credentials,
and cryptocurrency wallet artefacts. Public reporting places
panel infrastructure at storm-project.biz and describes a
subscription pricing model of roughly $300 for a seven-day
demo, $900/month for a standard seat, and $1,800/month for a
team tier that includes 100 operator seats and 200 builds.
Varonis analysis notes that the loader runs stages in memory
to reduce disk-based detection surface.
The panel writes a SystemInfo.txt per victim opening with a
Storm Stealer self-brand banner and the panel-support URL
https://storm-project.biz/support, followed by a geolocation
block (Remote IP, Location, State/Region, ZIP/Postal Code, Coordinates, Location Accuracy, Timezone, ISP,
AS Number), a device block (OS, Computer, User, AV,
CPU, RAM, GPU, Display), a numbered network-interface
block ([N] IP <v4> / MAC <mac> / GW <v4> / Name <adapter>), and a Launch: line recording the loader
execution mode. Sections are separated by U+2500 box-drawing
horizontal rules rather than ASCII dashes. The User: field
suffixes a bracketed Windows privilege class (sidne [User] /
admin [Administrator]) and the CPU: field emits only a
counts pair (4C / 8T) without the WMI-derived processor
model string that Redline, Lumma, and Rhadamanthys all
include.
