KuinaExtractor Uses Telegram Exfiltration, UAC Bypass, and Sandbox Detection for Stealth

KuinaExtractor (later rebranded k0to) is a Rust-based infostealer tracked over six months that steals browser data, cryptocurrency wallets, and service credentials; it progressively added evasion (XOR string obfuscation, custom certificate roots, sandbox checks), multiple UAC bypass techniques, and moved exfiltration from Discord webhooks to a Telegram bot, with researchers linking samples via shared mutexes, build paths, and Telegram handles and publishing IoCs and YARA rules.