Researchers have released a new report on the “SapphireStealer” malware, an open-source information stealer that was first released to the public in December 2022. Researchers detailed that “newly compiled versions of SapphireStealer began being uploaded to public malware repositories beginning in mid-January 2023, with consistent upload activity being observed through the first half of 2023.” Artifacts associated with three (3) samples indicated to the researchers that the malware is currently being used by various threat actors and that SapphireStealer’s capabilities are being improved. SapphireStealer was primarily designed to facilitate the exfiltration of browser credential databases and files that potentially contain sensitive user data. Once executed on a victim machine, the malware will attempt to stop any existing browser processes that are running on the system. The malware then attempts to locate and exfiltrate cached browser credentials and files stored on the system that match a predefined list of file extensions. Host information, including IP address, hostname, screen resolution, OS version, CPU architecture, GPU information, and more, is also collected and screenshots are taken of the system. Once all desired information is collected, the data is sent to the operator through Simple Mail Transfer Protocol (SMTP) using pre-defined credentials. In several cases involving new samples, researchers have identified the malware utilizing Discord’s webhook API as well as attempting to leverage the malware downloader “FUD-Loader” in its attack chain. Additional technical details of SapphireStealer’s activity as well as indicators of compromise (IOCs) can be viewed in the report linked below.