According to a CYFIRMA detailed analysis shared with Cyber Security News, PupkinStealer leverages Telegram’s Bot API for stealthy data exfiltration, underscoring the growing trend of exploiting legitimate platforms for malicious purposes. “The malware’s attribution string, “Coded by Ardent,” suggests a developer operating under this alias, with additional clues pointing to a possible Russian origin based on Russian-language text in related Telegram metadata.” Cyfirma said to Cyber Security News. A newly identified information-stealing malware, dubbed PupkinStealer, Developed in C# using the .NET framework, this lightweight yet effective malware targets sensitive user data, including browser credentials, desktop files, messaging app sessions, and screenshots. First observed in April 2025, PupkinStealer is a straightforward infostealer that targets a curated set of data, distinguishing it from more indiscriminate malware. All stolen data is compressed into a ZIP archive with embedded metadata (username, public IP, and Windows Security Identifier) and sent to an attacker-controlled Telegram bot via a crafted API URL. PupkinStealer exfiltrates data to a Telegram bot named botKanal (username: botkanalchik_bot), likely derived from the Russian word “kanal” (channel). PupkinStealer is designed for rapid data harvesting and operates with minimal obfuscation or persistence mechanisms, prioritizing quick execution over long-term stealth. It retrieves decryption keys from the browsers’ Local State files and uses the Windows Data Protection API to decrypt passwords stored in SQLite-based Login Data databases. The malware targets Telegram by copying the tdata folder, which contains session files that enable account access without credentials. It fits into a broader trend of modular, low-complexity infostealers available through malware-as-a-service models, enabling rapid monetization via credential theft, session hijacking, and data resale on dark web marketplaces.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 10 May 2025 12:05:02 +0000