“PupkinStealer” – New .NET Malware Harvests Browser Credentials and Sends Them via Telegram

CYFIRMA researchers have identified a new information-stealing malware variant, dubbed “PupkinStealer,” developed in C# atop the .NET framework.

This malware exemplifies modern infostealer trends, prioritizing focused data theft and covert exfiltration over persistence or advanced evasion.

PupkinStealer targets browser credentials, desktop files, active messaging sessions, and desktop screenshots-consolidating stolen data into a single archive which is then exfiltrated through the Telegram Bot API, leveraging the platform’s popularity and built-in anonymity.

PupkinStealer’s Workflow and Capabilities

Upon execution, PupkinStealer initiates a series of asynchronous tasks designed to harvest broad categories of sensitive information from the target system.

The infection chain begins with the extraction and decryption of browser credentials from Chromium-based browsers (such as Chrome, Edge, Opera, Opera GX, and Vivaldi).

The malware parses each browser’s “Local State” file to retrieve the os_crypt -> encrypted_key field, decrypting it using the Windows Data Protection API.

With the recovered key, it accesses and decrypts password entries from the browser’s “Login Data” SQLite databases.

In parallel, PupkinStealer combs the user’s desktop for files with .pdf, .txt, .sql, .jpg, or .png extensions-often associated with sensitive documents or personal data-and moves these files into a temporary working directory.

The malware is designed to remain silent in the event of access errors, prioritizing uninterrupted operation over error reporting.

A notable feature is its capability to hijack messaging sessions. PupkinStealer targets the Telegram Desktop “tdata” directory, copying complete session data, which can be used for account takeover without requiring credentials.

If the default tdata directory is absent, the malware parses the Telegram.lnk file to resolve the program’s true installation path, maximizing the chance of successful theft.

It employs a similar strategy for Discord, scanning multiple leveldb locations for authentication tokens using regex patterns, thus granting attackers unauthorized account access.

Another routine involves capturing the victim’s desktop screenshot at 1920×1080 resolution, storing the image locally for later exfiltration.

According to Cyfirma Report, after the harvesting phase, PupkinStealer compresses all collected artifacts into a ZIP archive.

Metadata-including the username, public IP, and Windows Security Identifier (SID)-is embedded within the archive’s comment field, enabling the operator to easily track and sort victim data.

Exfiltration Tactics and Attribution

Exfiltration occurs via the Telegram Bot API. The malware constructs a URL with the attacker’s bot token and chat ID, uploading the ZIP archive directly to a Telegram chat.

The exfiltration message caption further summarizes key system and theft metrics, embedding signature strings such as “Coded by Ardent.”

Attribution analysis points to a Russian-speaking developer operating under the alias “Ardent,” supported by embedded code strings and Telegram user bio metadata.

PupkinStealer’s design reflects the rising popularity of lightweight, modular infostealers distributed as malware-as-a-service.

Its use of Telegram for C2 and data exfiltration is consistent with contemporary trends, as the messaging service’s encryption and widespread adoption complicate traffic analysis and takedown efforts.

Unlike advanced stealers, PupkinStealer foregoes persistence and anti-analysis features, instead relying on speed, efficiency, and minimal footprint.

Organizations and individuals should implement robust endpoint detection and response (EDR) solutions, monitor for suspicious outbound Telegram traffic, and regularly update all software.

User education remains critical-particularly regarding the risks of downloading or opening files from unknown sources.

Proactive measures such as application whitelisting, behavior-based monitoring, and regular vulnerability assessments should be considered standard defensive practices.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates