Researchers have identified a new variant of the “ViperSoftX” cryptocurrency and information-stealing malware currently targeting password managers, including KeePass and 1Password. In the latest campaign, ViperSoftX targets a new range of browsers, including Brave, Opera, Edge, and Firefox, and impacts both the consumer and enterprise sectors. As of April 24, 2023, over 50% of the campaign’s activity has taken place in the United States, Australia, Japan, India, Taiwan, Malaysia, Italy, and France. The malware has evolved to have a stronger encryption measure of byte remapping, which increases analysis difficulty as analysts cannot correctly decrypt the encrypted shellcode without having the correct byte map. The malware is also changing its command-and-control (C2) server monthly in order to make detection evasion easier. Researchers explained that ViperSoftX arrives as “a software crack, an activator or a patcher, or a key generator (keygen)” and is often carried through the files of legitimate, non-malicious software in order to remain hidden while posing as illegal software versions. Once the victim machine has the carrier software, the malware checks for virtual machines, monitoring tools, and antivirus products. If the machine passes these checks, the malware then decrypts the Powershell code and downloads the malware’s main routine. Researchers noted that ViperSoftX is known as a cryptocurrency stealer and, in the new variant, still reviews for a wide range of cryptocurrency wallets in local directories as well as browser extensions. CTIX analysts will continue to monitor the evolution and activity of ViperSoftX and will provide new details as they become available. Indicators of compromise (IOCs) as well as additional technical details can be viewed in the report linked below.