logo

Immortal information stealer

ID: 28e06ec9-6ffe-5bb3-84e5-9708e8fa23d4

STIX ID: report--28e06ec9-6ffe-5bb3-84e5-9708e8fa23d4

Feed Name: Zscaler Security Research Blog

Threat Score
75/100

Date Published: 2025-09-18

Date Updated: 2026-05-01

...
...

Immortal is a .NET information stealer marketed on dark-web forums that harvests credentials, cookies, credit-card and autofill data from 24 Chromium-family browsers, exfiltrates application session and configuration files (including Steam, Telegram, Discord, FileZilla, Minecraft launchers), grabs Bitcoin wallet.dat, screenshots and webcam images, compresses the collection, and uploads it to an active command-and-control endpoint; the report provides filepaths, sample IOCs (MD5 and URLs), and evidence the builder/service is live.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.