Storm Infostealer Sold as Service, Targets Browsers, Wallets and Accounts

Varonis Threat Labs identified "Storm" infostealer (early 2026), a subscription-based malware that harvests browser credentials, session cookies, crypto wallets, and messaging account data from Chromium- and Gecko-based browsers. Using a server-side decryption technique that circumvents Chrome's App-Bound Encryption, Storm exfiltrates data to attacker-controlled servers, supports multi-monitor screenshots, and is sold commercially with evidence of active use in the wild (logs showing 1,715 victim entries across India, Brazil, the US, and the UK).