KuinaExtractor Stealer Targets Browser Data, Crypto Wallets, Roblox, Steam, and Discord

This report analyzes KuinaExtractor (rebranded “k0to”), a Rust-based infostealer that evolved from a capable prototype into a stealth-focused, production-grade threat between December 2025 and June 2026. It details broad credential and crypto-wallet theft (browser cookies, LSASS/App-Bound-Encryption bypass for Chrome, Steam/Discord/Roblox tokens), modularized privilege escalation (multiple UAC bypass methods), custom TLS and networking stacks, anti-analysis and sandbox detection, and operational shifts from Discord to Telegram for exfiltration. The analysis links builds via mutexes, build paths and Vietnamese-language artifacts to a likely single Vietnamese-speaking operator and notes active deployment and experimentation across multiple short-lived variants.