Phemedrone Stealer

Phemedrone Stealer is a malicious software (malware) that infiltrates systems to exploit and damage them, often stealing personal information or disrupting operations. This malware can infect systems through suspicious downloads, emails, or websites, often without the user's knowledge. It was observed being used in attacks targeting a Windows Defender SmartScreen vulnerability, CVE-2023-36025, earlier in the year. The core functionality of another malware, Styx Stealer, was found to be entirely copied from Phemedrone Stealer, indicating its significant influence in the cybercrime landscape. Through comparative analysis of various versions of Phemedrone Stealer and Styx Stealer, researchers discovered multiple features present in the former that were absent in the latter. For instance, Phemedrone Stealer version 2.1.1, dated September 1, 2023, contained certain functionalities not found in the analyzed sample of Styx Stealer. These findings suggest that the code of Styx Stealer is based on an early version of Phemedrone Stealer, released before September 2023. The latest versions of Phemedrone Stealer have evolved to include more sophisticated features such as a unique tagging feature and the ability to send data to Telegram, encrypted with a unique key for each campaign. These advancements demonstrate the continuous development and adaptation of this malware, emphasizing the need for robust cybersecurity measures to counteract these threats.