New Python-Based Snake Info Stealer Spreading Through Facebook Messages
ID: 75cafffd-0393-52d7-915a-d3134c54f888
STIX ID: report--75cafffd-0393-52d7-915a-d3134c54f888
Feed Name: The Hacker News
A Python-based information stealer dubbed “Snake” is being propagated via Facebook messages that deliver RAR/ZIP attachments which trigger batch/cmd downloaders to fetch the stealer from actor-controlled GitLab/GitHub repositories; variants include a PyInstaller-built executable. The malware collects browser credentials and cookies (including Facebook-specific cookies and support for the Vietnamese Cốc Cốc browser) and exfiltrates data as ZIP archives to services like Telegram, Discord, and GitHub, indicating active account takeover and targeted abuse of social platforms.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.