A new info-stealer malware called “Prynt Stealer” was recently spotted in the wild by Cyble research labs. Prynt Stealer is advertised as a subscription-based tool, with subscription options of $100/month, $200/quarter, $700/year or $900 for a lifetime license. Currently, the malware, which is customizable by the purchaser, can steal data from over thirty (30) Chromium-based browsers, at least five (5) Firefox-based browsers, three (3) confirmed VPNs, and a range of FTP, messaging, and gaming apps. The malware begins by scanning all host drives and exfiltrates files that are smaller than 5,120 bytes. Next, it targets autofill data, credentials, payment card info, browser search history, and cookies stored in browsers. Prynt Stealer then targets messaging apps (Discord, Telegram, etc) as well as gaming authorization files before querying the registry for cryptocurrency wallets to empty. Data and credentials for VPNs are stolen, and the malware lastly enumerates and screenshots the current running processes, network credentials, and the Windows product key. Exfiltration occurs through a Telegram bot that uses a secure encrypted network connection to send the compressed data to a remote server. In addition to the previously mentioned data stealing tactics, Prynt Stealer is also equipped with a clipper tool that monitors the compromised machine’s clipboard to identify and replace cryptocurrency addresses and a keylogger designed to perform bulk information stealing. Additional details as well as indicators of compromise (IOCs) can be reviewed in Cyble’s report linked below.