The Shocking Mistake That Unmasked Styx Stealer: A Deep Dive into New Crypto Malware

Check Point Research (CPR) has recently uncovered Styx Stealer, a sophisticated malware designed to steal browser data, cryptocurrency, and instant messenger sessions. Styx Stealer is a variant of Phemedrone Stealer and introduces several new features, including auto-start and crypto-clipping.

The malware was traced back to a developer associated with the notorious Agent Tesla threat actor, known as Fucosreal. A crucial mistake during debugging led to the leak of sensitive data, enabling CPR to gather extensive intelligence on the malware's clients, profits, and personal details. This slip not only exposed the developer's identity but also revealed connections between Styx Stealer and a broader cybercrime network, showcasing interactions with other cybercriminals like Fucosreal.

CPR's investigation highlighted that Styx Stealer is based on an older version of Phemedrone Stealer, lacking some advanced features. The creator's failure in operational security (OpSec) compromised the entire campaign, allowing CPR to identify the individuals involved, including their locations and personal details. Despite efforts to distribute the malware, the overall campaign has largely failed, underscoring the importance of security practices in the cybercrime landscape.