Unix Stealer is built to harvest data in bulk: browser passwords and cookies, VPN and FTP credentials, messaging and gaming data, crypto wallets, screenshots, clipboard data, and Wi-Fi credentials, then exfiltrate the collection quickly.
Despite its name, Unix Stealer is a Windows-only threat. The name comes from ‘Unix,’ the Russian-language hacking platform that develops and sells it, not from the operating systems it targets.
CyOps pulled apart a live sample to understand how it collects, stages, and exfiltrates sensitive data, and where defenders have opportunities to catch it.
Built to minimize disk artifacts
Unlike many infostealers that collect data into a local staging directory before exfiltration, Unix Stealer builds its final ZIP archive in memory. Credentials, browser data, wallet information, and other collected artifacts are compressed in memory before being sent out in a single exfiltration step.
That reduces one class of disk-based artifacts defenders might otherwise use to identify collection and staging activity. But it does not make the malware invisible. Process behavior, access to sensitive credential stores, and outbound network activity can still expose it to EDR and behavioral detection.
The sample is a .NET executable, and its configuration (recoverable through decompilation) shows which modules are enabled, including browser credential theft, a keylogger, webcam and screenshot capture, and a file grabber that scans for saved passwords and seed phrases. A clipboard clipper module — capable of swapping copied crypto wallet addresses — is present in the code but was disabled in this sample. Separate configuration flags control which application categories get targeted, including VPN clients, messaging apps, and gaming clients.
What it targets
The scope is broad by design. Commodity infostealers like Unix Stealer are built to cast a wide net, collecting large volumes of data in hopes of finding valuable credentials, sessions, or financial assets among the noise.
Unix Stealer enumerates a long list of VPN clients, including NordVPN, ExpressVPN, ProtonVPN, and WireGuard, along with remote-access and file-transfer tools. It targets major Chromium- and Gecko-based browsers for credentials, cookies, and other stored data, the same valuable browser attack surface CyOps examined in The Browser Threat Vector: Lessons from the WhoUser Infostealer.
Crypto receives especially extensive attention. Unix Stealer searches for browser extensions and desktop applications associated with MetaMask, Ledger Live, Exodus, Electrum, and dozens of other wallets. Its file grabber also searches for files containing terms such as “mnemonic,” “seed,” and “private key,” looking for recovery phrases and other high-value secrets stored in plaintext.
The malware also attempts to collect saved Wi-Fi credentials using Windows’ native netsh utility. It exports WLAN profiles to XML and parses the resulting data for stored credentials, giving defenders another behavioral signal to monitor.
Exfiltration over Telegram
Once collection is complete, Unix Stealer sends its in-memory ZIP archive to a hardcoded Telegram bot through the Bot API.
That lets the operator abuse a legitimate encrypted service as an exfiltration channel rather than relying on dedicated attacker-controlled infrastructure. The request also includes a formatted summary of the collection, including passwords harvested, cookies collected, and wallets found, giving the operator an immediate view of what is available from a newly infected host.
CyOps traced the builder’s promotion to Russian-language Telegram and Discord channels associated with the Unix platform, where it is offered alongside several other stealer families. The model reflects the broader malware-as-a-service economy: capable credential-stealing malware packaged, sold, and supported for buyers who do not need to develop their own tooling.
Detection
Cynet ran the sample in detection mode, without prevention enabled, to allow CyOps researchers to observe its execution chain.
Cynet’s detection engine flagged the malicious binary immediately. File-activity monitoring also identified attempts by the stealer to access sensitive browser credential stores — the same type of behavior Cynet has previously demonstrated against StealC Infostealer.
Who’s targeted
Unix Stealer is sold as a commodity tool through the Unix platform’s Telegram and Discord presence, alongside several other stealer families, meaning any of the platform’s paying customers can point it at whatever victims they choose. That distribution model spreads the risk wide: remote workers with saved VPN credentials, gamers and streamers with linked accounts and payment details, and, given the depth of the crypto wallet targeting list, anyone holding cryptocurrency in a browser extension or desktop wallet. The seed-phrase file grabber is built specifically to find and exfiltrate crypto recovery phrases stored in plain text, which is a common enough habit that it remains one of the most reliable payoffs for stealer operators. Volume is the name of the game, and cybercriminals using Unix Stealer are banking on finding needles in the haystacks of data being exfiltrated.
This follows a pattern CyOps is seeing more often in the wild: commodity infostealers built and sold as accessible, low-effort tools that any buyer can run, rather than bespoke malware built for a single campaign. We’ve tracked the same playbook in our write-ups on StealC and WhoUser, two other MaaS stealers sold the same way. The barrier to entry for this kind of attack keeps dropping, which means the volume of infected hosts keeps climbing.
Key takeaways for defenders
- Don’t rely on antivirus or disk-based detection alone. Unix Stealer never writes its collected data to disk, staging everything in memory instead, so EDR and behavioral monitoring that watches process activity and API calls is what actually catches this family.
- Flag outbound connections to api.telegram.org from processes that have no business talking to Telegram. That single indicator, an unexpected process making Bot API calls, is one of the most reliable signals available for this entire category of malware, not just this sample.
- Discourage saved passwords and auto-fill credentials in browsers, and push multi-factor authentication everywhere it’s supported, especially on VPN, email, and crypto wallet access. Unix Stealer’s browser and wallet modules assume credentials are sitting in the places people usually leave them.
- Move crypto holdings, and any other high-value credentials or seed phrases, out of browser extensions and plaintext files and into hardware wallets or a dedicated password manager. The stealer’s file grabber is explicitly built to search for exactly those artifacts.
- Watch for netsh wlan export activity on endpoints. It’s an unusual command for normal business use, and Unix Stealer relies on it to pull cleartext Wi-Fi credentials.
- Treat any host that’s run an unrecognized or unsigned binary, even briefly, as a credential-reset event. Given how thorough this stealer’s collection is, assume every credential that was accessible on that machine needs to be rotated.
The in-memory staging and Telegram exfiltration make Unix Stealer harder to catch with disk- and network-signature approaches alone. Behavioral detection, watching what a process touches rather than just what it writes to disk, is critical as cyber criminals adopt more sophisticated evasion practices.