Legion Stealer targeting PUBG players

CRIL identified a malicious GitHub repository disguised as a PUBG bypass that distributes a renamed .Scr executable masquerading as a .sln file; execution drops and launches a .NET-based Legion Stealer which disables Defender, performs anti-analysis checks, harvests browser credentials, cookies, crypto wallets, game session files, and system information, then compresses and exfiltrates stolen data via Discord webhooks. The report includes static indicators (file hashes), a mapped set of MITRE ATT&CK techniques, a detailed description of the infection chain and capabilities, and recommended mitigations.