Gremlin Stealer Malware Targets Browsers, Crypto Wallets, and VPNs in Telegram-Based Campaign

Unit 42 describes Gremlin Stealer, a newly observed, actively developed C# infostealer sold via a Telegram group that harvests browser data (including bypassing Chrome V20 cookie protections), crypto wallet files, session credentials and screenshots, then uploads collected data to a C2 server (207.244.199.46) and a Telegram bot; the report highlights its self-contained, modular design, active development, and recommends layered defenses including monitoring outbound connections and blocking known infrastructure.