Right here’s what to know in regards to the malware with an insatiable urge for food for useful information, a lot in order that it tops this yr’s infostealer detection charts
22 Oct 2025
•
,
3 min. learn
Infostealers stay some of the persistent threats on at this time’s menace panorama. They’re constructed to quietly siphon off useful info, sometimes login credentials and monetary and cryptocurrency particulars, from compromised methods and ship it to adversaries. And so they accomplish that with nice success.
ESET researchers have tracked quite a few campaigns lately the place an infostealer was the ultimate payload. Agent Tesla, Lumma Stealer, FormBook and HoudRAT proceed to make the rounds in massive numbers, however in response to the ESET Risk Report H1 2025, one household surged forward of the remainder within the first half of this yr: SnakeStealer.
A menace is born
Detected by ESET merchandise primarily as MSIL/Spy.Agent.AES, SnakeStealer first appeared in 2019. Early stories traced it to a menace initially marketed as 404 Keylogger or 404 Crypter on underground boards earlier than it rebranded underneath its present title.
In its early variants, SnakeStealer used Discord to host its payloads, which victims unwittingly downloaded after opening a malicious e-mail attachment. Whereas internet hosting malware on reliable cloud platforms wasn’t new, the widespread abuse of Discord quickly turned a trademark tactic. SnakeStealer reached its first massive wave of exercise in 2020 and 2021, spreading globally with none clear regional focus.
In the meantime, the supply strategies different. Phishing attachments nonetheless stay the first vector, however the payload itself could also be disguised in varied types, together with password-protected ZIP recordsdata, weaponized RTF, ISO and PDF recordsdata, and even bundled with different malware. Sometimes, SnakeStealer hides inside pirated software program or faux apps, which speaks to the truth that not each compromise begins with a malicious e-mail.
Malware-as-a-service: A worthwhile ‘enterprise mannequin’
Like many different trendy threats, SnakeStealer follows the malware-as-a-service (MaaS) mannequin. Its operators lease or promote entry to the malware, full with technical help and updates, which makes it simple for even low-skilled attackers to launch their very own campaigns.
SnakeStealer’s current resurgence is not any coincidence. After Agent Tesla started to say no and lose developer help, underground Telegram channels began recommending SnakeStealer as its successor. This endorsement, mixed with the comfort of its MaaS setup and its ready-made infrastructure, propelled SnakeStealer to the highest of detection charts, a lot in order that SnakeStealer was lately liable for virtually one-fifth of worldwide infostealer detections as tracked by ESET telemetry.
Key options
SnakeStealer might not break new floor, but it surely’s polished, dependable, and straightforward to deploy. It gives a full toolkit of capabilities that’s typical of professional-grade info-stealing malware, and given its modularity, attackers can change options on or off to swimsuit their wants.
- Evasion: With a purpose to keep underneath the radar, SnakeStealer can terminate processes related to safety and malware evaluation instruments and verify for digital environments.
- Persistence: It alters Home windows boot configurations to take care of entry on compromised methods.
- Credential theft: It extracts saved passwords from internet browsers, databases, e-mail and chat shoppers, together with Discord, and Wi-Fi networks.
- Surveillance: It captures clipboard information, takes screenshots and logs keystrokes.
- Exfiltration: It sends stolen information through FTP, HTTP, e-mail, or Telegram bots.
Find out how to defend your self
Whether or not you’re a person person or a enterprise, these steps can assist cut back the chance towards infostealers like SnakeStealer:
- Be skeptical of unsolicited messages. Deal with attachments and hyperlinks, particularly from unknown senders, as potential threats, even when they seem reliable. Confirm them with the sender by different channels.
- Hold your system and apps up to date. Patching identified vulnerabilities in a well timed method reduces the chance of compromise stemming from software program loopholes.
- Allow multi-factor authentication (MFA) wherever potential. Even when your password is stolen, MFA can cease unauthorized logins.
- For those who suspect a compromise: change all passwords from a clear system, revoke open periods, and monitor your accounts for suspicious exercise.
- Use respected safety software program on all gadgets, desktop and cell alike.
Remaining ideas
SnakeStealer’s rise is a reminder of how shortly the cybercrime market adapts and as such displays a bigger fact about at this time’s menace panorama: cybercrime has industrialized. This professionalization makes it simpler than ever for anybody to steal information at scale. And as one infostealer fades, one other fills the hole, armed with largely the identical tried-and-tested ways. The excellent news is that robust cybersecurity practices will go a great distance in direction of retaining you protected.
