New Infostealer ‘Fickle Stealer’ Targets Sensitive Data Using Multiple Distribution Methods

Security experts are raising alarms about a new infostealer named Fickle Stealer, which is being disseminated through various techniques across the internet. Fickle Stealer engages in typical malicious activities, such as stealing sensitive files, system information, browser-stored files, and cryptocurrency wallet details. However, what sets Fickle Stealer apart is its construction using the Rust programming language.

“Beyond targeting popular applications, this stealer searches for sensitive files in the parent directories of common installation paths to ensure thorough data collection,” stated security researcher Pei Han Liao. “It also fetches a target list from the server, adding flexibility to Fickle Stealer’s operations.”

According to cybersecurity researchers from Fortinet FortiGuard Labs, Fickle Stealer employs four distinct distribution methods: a VBA dropper, a VBA downloader, a link downloader, and an executable downloader. Some of these methods utilize a PowerShell script that bypasses User Account Control (UAC) mechanisms. This script also transmits system information, such as the device’s location (country and city), IP address, operating system version, computer name, and username, to a Telegram bot.

Infostealers are among the most prevalent and disruptive forms of malware, second only to ransomware. They enable cybercriminals to access sensitive services, including banking accounts, social media profiles, and corp

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.