SapphireSteale Open-source information stealer enables credential and data theft
31-Aug-23
Since its initial public release in December 2022, the open-source information stealer SapphireStealer has been increasingly common in public malware archives. Sensitive information, including business credentials, can be obtained via information-stealing malware like SapphireStealer, which is frequently sold to other threat actors who utilize the access for further attacks, such as espionage or ransomware/extortion schemes.
We estimate that SapphireStealer is being used by numerous entities, each of which has independently enhanced and changed the original code base to allow additional data exfiltration techniques, resulting in the development of a number of versions.x000D When threat actors use open-source malware downloaders like FUD-Loader to spread SapphireStealer to potential victims, it sometimes looks to be part of a multi-stage infection process.
