Album Stealer
ID: 2425c477-dda4-5f68-a557-4949e701aef6
STIX ID: report--2425c477-dda4-5f68-a557-4949e701aef6
Feed Name: Zscaler Security Research Blog
Threat Score
This technical analysis details the "Album Stealer" information-stealing campaign: attackers distribute malicious ZIPs via Facebook redirect links and shared OneDrive/CDN hosts, use DLL side-loading of legitimate signed binaries to execute encrypted payloads, establish persistence via Run registry keys, fetch additional modules from C2, and harvest browser credentials, cookies, and Facebook business/ad account data for exfiltration.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.