Dark Partners cybercrime gang fuels large-scale crypto heists
ID: 66b461f1-22dc-5e9c-bcc8-ad83ea37d3d2
STIX ID: report--66b461f1-22dc-5e9c-bcc8-ad83ea37d3d2
Feed Name: Bleeping Computer
Threat Score
A criminal campaign dubbed 'Dark Partners' uses hundreds of fake download sites impersonating popular AI, VPN, crypto, and productivity apps to deliver Poseidon (macOS) and Lumma (Windows) infostealers and the PayDay loader; these tools exfiltrate browser credentials, private keys, and wallet folders to steal cryptocurrency, employ code-signing certificates and advanced persistence (VHD in NTFS ADS), and have been documented with nearly 250 malicious domains and IoCs by researcher g0njxa.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.