Prynt Stealer’s Backdoor Exposed

Zscaler ThreatLabz reports that Prynt Stealer is a .NET information-stealer derived from AsyncRAT and StormKitty which harvests credentials, browser data, and other sensitive files and exfiltrates them via Telegram; the builder contains a hardcoded backdoor that also forwards stolen logs to the author's Telegram channel, increasing exposure to multiple threat actors. The analysis documents near-identical variants (WorldWind, DarkEye), a leaked/backdoored builder that can deploy additional malware (DarkEye, LodaRAT), anti-analysis behaviors, and publishes IOCs (SHA256 hashes, Telegram tokens/chat IDs, C2 URLs) to enable detection and response.