Phishing Site used to Spread Typhon Stealer

## Executive Summary Cyble Research Labs identified and analyzed a Typhon stealer sample distributed via a phishing site impersonating a Swedish municipality and a crafted .lnk file; the stealer (Prynt-based) exfiltrates credentials, cookies, crypto wallets, VPN and FTP data, supports clipboard hijacking, keylogging, file grabbing, and can upload stolen data to Telegram/AnonFiles, while the actor sells the malware and related services on Telegram and is developing XMRig miner delivery capabilities.