SolyxImmortal is a commodity Python information stealer targeting Windows endpoints, first observed in January 2026 and analyzed publicly by CYFIRMA, SecurityWeek, PolySwarm, SOC Prime, and Cyber Security News. The sample (Lethalcompany.py, 10.29 KB, SHA-256 5a1b440861ef652cc207158e7e129f0b3a22ed5ef5d2ea5968e1d9eff33017bc) is a single, dependency-light script that bundles credential theft, cookie theft, keylogging, screen surveillance, document harvesting, and persistence into one continuously running implant. It runs entirely in user context with no UI or console output and requires no administrative privileges.

Execution flow: a central controller class initializes on launch, resolving %TEMP% and the user home directory for staging, then establishes persistence before spawning concurrent surveillance threads. Persistence is achieved by copying the script (packaged as an executable) into %APPDATA%\WindowsGraphics\win_gfx_driver.exe, applying Hidden and System attributes to reduce visibility, and writing the value 'WindowsGfxDriver' under HKCU\Software\Microsoft\Windows\CurrentVersion\Run so the implant relaunches at every user logon (T1547.001, T1564.001).

Credential theft targets Chromium-based browsers (Chrome, Edge, Brave, OperaGX). The malware reads the AES-GCM master key from each browser's Local State file, unwraps it with the Windows DPAPI bound to the current user, and decrypts the Login Data SQLite database to recover plaintext usernames and passwords (T1555.003, T1552.001). Recovered credentials are aggregated in plaintext into a file named sifreler.txt (Turkish for 'passwords'). Firefox cookies are stolen by directly copying the profile's cookie database rather than decrypting them.

Surveillance runs on dedicated threads. A persistent keyboard listener buffers keystrokes in memory, converting special keys (Enter, Backspace, modifiers) to readable tokens, and a background thread serializes the buffer to JSON and exfiltrates it roughly every 60 seconds before clearing it (T1056.001). An active-window monitor compares foreground window titles against keyword sets (including Turkish-language terms for banking sites, Gmail, and sign-in pages); on a match it captures and immediately transmits a screenshot (saved as alert.png) to a dedicated screenshot webhook, and it also takes routine screenshots roughly every 2 minutes regardless of activity (T1113). Document harvesting recursively enumerates the user home directory, filtering by extension (.doc, .pdf, .xls, etc.) and size thresholds, stages files in a %TEMP% folder named Solyx_Pack_Final, and compresses them into Solyx_Final_Data.zip (T1083, T1005).

Exfiltration uses two hardcoded Discord webhooks over HTTPS POST (via the Python requests library): one for structured data (credentials, document archives, keystroke logs) and a second dedicated to screenshots (T1041, T1567.004, T1102.003). A hardcoded Discord user ID is embedded so the operator is @-mentioned on high-value events. After successful transmission, staging files are deleted to reduce forensic artifacts, although the implant itself persists indefinitely. The actual webhook URLs and Discord user ID were not disclosed in public reporting.

The malware uses limited obfuscation — it relies on Discord's trusted HTTPS infrastructure and reputation for evasion, compresses harvested data, and wraps operations in silent exception handling so it does not crash or surface error dialogs (T1027). Attribution is medium confidence to a Turkish-speaking developer based on linguistic, structural, and operational indicators (e.g., the sifreler.txt artifact and Turkish keyword lists) and distribution via Telegram channels serving low-to-medium-sophistication, hacktivist-oriented actors rather than structured cybercrime. The threat is opportunistic: any organization whose users execute the script is at risk of browser credential, cookie, document, keystroke, and screen compromise.