BlackFog researchers have discovered a sophisticated new Malware-as-a-Service (MaaS) known as Venom Stealer. Unlike traditional commodity stealers like Lumma, Vidar, or RedLine, Venom offers a complete, automated data theft pipeline.
It integrates deceptive social engineering directly into its control panel. It establishes a continuous data exfiltration cycle that remains active long after the initial compromise.
Deceptive Delivery and Silent Data Extraction
The attack chain begins when a victim visits a malicious webpage hosting a ClickFix lure.
Venom provides its operators with four distinct templates designed for both Windows and macOS systems: a fake Cloudflare CAPTCHA, an operating system update prompt, an SSL certificate error, and a fake font installation page.
These pages trick the user into opening a Run dialog or Terminal, pasting a specific command, and pressing Enter.
Because the user manually triggers the action, the execution appears legitimate. It easily bypasses security tools that monitor for suspicious parent-child process relationships.
Windows payloads use various formats, such as EXE, HTA, BAT, and fileless PowerShell scripts. At the same time, macOS versions rely on bash and curl commands.
Continuous Monitoring and Crypto Draining
Venom Stealer does not just grab data once and exit. Any cryptocurrency wallet data it finds is instantly sent to a server-side cracking engine powered by GPUs.
This system automatically cracks popular wallets like MetaMask, Trust Wallet, Phantom, and Electrum. Once cracked, an automated script immediately drains funds across nine different blockchain networks.
A recent update also added a feature that scans the victim’s local files for saved seed phrases and feeds them directly into the cracking pipeline.
This means even users who avoid saving passwords in their browsers are at severe risk if they store recovery phrases anywhere on their hard drives.
What truly sets Venom apart from older infostealers is its persistence. It remains active on the infected device, continuously monitoring Chrome’s Login Data files blackfog to capture newly saved passwords in real time.
This continuous monitoring undermines standard incident response strategies like credential rotation, as any new passwords are stolen the moment the user types them. This creates a prolonged exfiltration window, making it incredibly difficult to determine the full scope of a breach.
Defending against Venom Stealer requires a multi-layered approach. Organizations can reduce their exposure by using Group Policy to block standard users from accessing the Run dialog, restricting PowerShell execution, and training staff to spot ClickFix lures.
Furthermore, because the entire attack relies on moving stolen data quickly, monitoring and blocking unauthorized outbound network traffic is critical.
Solutions that focus on anti-data exfiltration (ADX) can intercept these unauthorized transfers in real-time, effectively cutting off the theft pipeline before cybercriminals can monetize the data.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 known as Venom Stealer. Unlike traditional commodity){kind=link}