“ExelaStealer”, a newly discovered information-stealing malware, has been observed being offered for sale in hacking forums as well as in a dedicated Telegram channel run by its operators “quicaxd”. ExelaStealer is mainly written in Python and described as a “largely open-source infostealer with paid customizations available from the threat actor.” The paid-for version of ExelaStealer currently costs $20 per month, $45 for three (3) months, and $120 for a lifetime license, which allows threat actors of all levels to conduct malicious cyberattacks using the malware. Researchers noted that there is evidence that ExelaStealer is being distributed through an executable that disguises as a PDF document, which is commonly observed being used in phishing attacks and watering hole attacks. The infostealer currently targets Windows users and has the capabilities to exfiltrate passwords, Discord tokens, screenshots, keystrokes, credit cards, cookies, session data, and clipboard data. Researchers explained that the first public mention of ExelaStealer occurred in August 2023. Technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.