Extra credit: VietCredCare information stealer takes aim at Vietnamese businesses

Group-IB uncovered VietCredCare, a Vietnam-focused .NET information stealer active since at least August 2022 that exfiltrates browser cookies and credentials to attacker-controlled Telegram bots. Offered as stealer‑as‑a‑service and advertised on social platforms, VietCredCare specifically filters Facebook credentials and checks Meta ad balances to prioritize takeover of business pages; it has compromised victims across 44 Vietnamese provinces including government agencies, universities, banks and major enterprises, uses persistence and evasion (packing, Windows Defender exclusions, AMSI disabling), and remains actively promoted and in use.