Vikro Stealer

Vikro Stealer is an advanced piece of malware that is being sold on Russian-speaking forums. The threat is able to exfiltrate various data types from infected hosts, and it can be used for long-term attacks thanks to its ability to steal files from infected systems. Needless to say, Vikro Stealer has huge capabilities, and it is not a threat that should be underestimated. Another reason to be afraid by the Vikro Stealer is that it can be used by anyone – the original author of the project is selling access to their tool so that other cybercriminals can use it. This means that there may be dozens of cybercriminals that are simultaneously spreading variants of the Vikro Stealer online.

The main features of this stealer enable it to:

• Collect Web browser information such as history, cookies, passwords and autofill forms.
• Collect session files and data related to popular software like Jabber, Steam, Telegram and Discord.
• Collect VPN credentials and configuration files.
• Collect information from email clients.
• Hijack RDP connections to provide the attacker with remote access to the infected computer.
• Collect client profiles for various FTP clients.

Vikro Stealer is very small in size, and it will not cause any visible changes to the infected computer, therefore allowing it to stay hidden for as long as possible. The only reliable way to identify and stop this threat is to use an up-to-date anti-malware service.