'Ov3r_Stealer' Malware Spreads Through Facebook to Steal Crates of Info

Trustwave SpiderLabs identified a novel infostealer named Ov3r_Stealer being propagated through Facebook job ads, fake accounts and weaponized links that lead to Discord/GitHub-hosted payloads; the malware exfiltrates credentials, cookies, crypto wallets, documents, system and AV info to a Telegram channel. Researchers observed multiple loaders and execution techniques — CPL-based PowerShell, HTML smuggling, SVG/WinRAR exploitation, and malicious LNK shortcuts — a three-file nested payload (WerFaultSecure.exe -> Wer.dll -> Secure.pdf), scheduled-task persistence, and actor aliases/forums tied to distribution and data handling; IoCs and mitigation recommendations are provided.