EDDIESTEALERMalware
According to Elastic Security Labs, this is a newly discovered Rust infostealer targeting Windows hosts, which receives a task list from the C2 server identifying data to target.From MISP Galaxy
Last reported 12 months ago, by Elastic Security Labs3 reports
ATT&CK techniques
6 of 15 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter”
- T1105Ingress Tool Transfer
“Ingress Tool Transfer via PowerShell”
- T1217Browser Information Discovery
“Potential Browser Information Discovery”
- T1684Social Engineering
“Unlike their legitimate counterparts, fake CAPTCHAs serve as gateways for malware, leveraging social engineering to deceive users.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
What the reports say
3 reports, newest first · the exact sentence from each-
What the 2025 Elastic Global Threat Report reveals about the evolving threat landscape“Threat profiles for BANSHEE, EDDIESTEALER, and ARECHCLIENT2 demonstrate how some of the most popular novel discoveries from the Elastic Security Labs team used infostealers.”
-
A Wretch Client: From ClickFix deception to information stealer deployment“Our recent Elastic Security research on EDDIESTEALER provides another concrete example of ClickFix's efficacy in facilitating malware deployment, further underscoring its versatility and widespread adoption in the threat landscape.”
-
Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns“We are calling this malware EDDIESTEALER.”
Indicators in its reports
named in the reports above- 107.189.24[.]67in 1 report
- 185.156.72[.]80in 1 report
- 50.57.243[.]90in 1 report
- hxxps://clients.contology[.]com/captcha/in 1 report
- clients.contology[.]comin 1 report
- contology[.]comin 1 report
- hxxps://api.ipify[.]org/?format=jsonin 1 report
- hxxps://koonenmagaziner[.]click/counter/<IP_addressin 1 report
- koonenmagaziner[.]clickin 1 report
- hxxps://shorter[.]me/XOWyTin 1 report
- hxxps://bitly[.]cx/iddDin 1 report
- bitly[.]cxin 1 report
- 144.172.97[.]2in 1 report
- 143.110.230[.]167in 1 report
- hxxps://pastebin[.]com/raw/Wg8DHh2xin 1 report
- clients.dealeronlinemarketing[.]comin 1 report
- 82cddf3a9bff315d8fc708e5f5f85f20in 1 report
- 66.63.187[.]22in 1 report
- 45.94.47[.]164in 1 report
- 84.200.17[.]129in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.