Extra credit: VietCredCare information stealer takes aim at Vietnamese businesses

Group-IB analyzed VietCredCare, a .NET Windows information stealer active since at least August 2022 that targets users in Vietnam and exfiltrates browser cookies and credentials via Telegram bots; it uniquely filters for Facebook business accounts with positive Meta ad credit balances to prioritize account takeover. The stealer is offered as stealer‑as‑a‑service, distributed via phishing and social messaging (Zalo, Facebook, Telegram), advertised publicly, and has victimized organizations across 44 provinces including government bodies, banks, universities and enterprises, posing reputational and financial risks.