MaaS VIP Keylogger Campaign Uses Steganography and In-Memory Execution to Steal Credentials at Scale

A widespread spear‑phishing campaign distributes VIP Keylogger — an in‑memory, modular credential‑stealing malware that harvests credentials, cookies, credit‑card data and tokens from numerous browsers, email clients and apps and exfiltrates via SMTP, FTP, Telegram, HTTP POST or Discord; it evades detection using steganography, process hollowing and AMSI/ETW bypass and appears offered as configurable Malware‑as‑a‑Service, enabling scaled abuse.