Threat reportMalwareTL-2026-0867
Pony (Fareit/Siplog) Credential-Stealing Trojan and Downloader
Pony (Fareit/Siplog) Credential-Stealing Trojan and (TL-2026-0867), also tracked as Pony, is a high-severity malware campaign, first published 2026-06-19. It has no confirmed attribution, affects Microsoft Windows, maps to 30 MITRE ATT&CK techniques (T1005, T1012, T1027), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 30MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-0867
- Threat ID
- TL-2026-0867
- Also known as
- Pony, Pony Stealer, Pony Loader, Fareit, Siplog
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- financial, government, healthcare, technology, retail, general
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Pony (Fareit/Siplog) Credential-Stealing Trojan and
Malware and tooling: ZeuS/Zbot, Pony Builder
How Pony (Fareit/Siplog) Credential-Stealing Trojan and works
Pony, also tracked as Fareit and Siplog, is a Windows credential-stealing trojan with an integrated downloader, first observed in 2011 and still active through June 2026. It harvests stored credentials from 100+ applications (web browsers, FTP/SSH clients, email clients, instant messengers, RDP sessions, and 36+ cryptocurrency wallets), brute-forces local Windows accounts with a built-in password dictionary, and delivers second-stage payloads such as ZeuS/Zbot.
Pony (Fareit/Siplog) is a modular, assembly-based information stealer and downloader for Windows that has been in continuous circulation since 2011. The malware ships in two parts: a graphical 'Pony Builder' point-and-click configurator that lets non-developers set the C2 panel URL, second-stage payload URLs, executable icon, and feature toggles (loader activation, duplicate-run prevention); and the compiled bot/loader written largely in hand-crafted x86 assembly. Each build produces a distinct binary despite identical logic, frustrating signature detection.
After execution the loader fingerprints the host (CPU architecture via GetNativeSystemInfo / IsWow64Process, hardware ID derived from a WinRAR registry value or, as a fallback, a GUID from CoCreateGuid), then walks the user profile (AppData, Local AppData, Cache, Cookies, History) and parses application-specific credential stores. Public technical analyses document on the order of 134 dedicated harvesting routines covering 15+ browsers (Chrome 'Login Data'/'Web Data', Firefox SQLite/text stores, Opera, Yandex), 50-62 FTP clients (FileZilla sitemanager.xml/recentservers.xml, WinSCP registry, SmartFTP), email clients (Outlook, Thunderbird, The Bat!, Becky!), RDP .rdp files, certificate private keys (OID 2.5.29.37), and 36-40 cryptocurrency wallets (Bitcoin wallet.dat, Litecoin, Electrum, Armory). It can additionally brute-force local Windows accounts with a built-in dictionary of common passwords (e.g. '123456') via NetUserEnum/LogonUserA.
Harvested data ('passbag') is exfiltrated to an attacker-operated PHP panel using a hand-built HTTP POST over raw Winsock with a fixed Internet Explorer 8 User-Agent. The body is protected with a two-stage RC4 scheme: the passbag is checksummed and RC4-encrypted with a hardcoded key (e.g. 'password22'), then re-encrypted with a randomly generated key that is appended to the blob, so decryption happens server-side. C2 endpoints follow recognizable gate.php conventions (/pony/gate.php, /ponyd/gate.php, /v6/gate.php, .../panel/gate.php). Once data is sent the bot can download and execute second-stage malware (most famously ZeuS/Zbot in a 2013 campaign) and self-deletes its loader via a temporary %TEMP% batch script.
Pony is heavily armored: software packing in a nested 'matryoshka' / custom-crypter layout, PUSH-to-RET and rogue-byte (0xFE padding) control-flow obfuscation to defeat disassemblers, GetTickCount/heuristic timing loops and time-based delays to evade sandboxes, PEB BeingDebugged checks, Sandboxie detection (sandboxierpcss), VM detection via WMI video-controller queries, and Avast/AVG detection through the snxhk.dll hook library (some .NET-wrapped variants perform process hollowing into RegASM.exe). The public leak of Pony builder/loader source for versions 1.9 and 2.0 on underground forums has driven extensive customization and reuse; observed versions range from 1.7 through 2.2. It is widely distributed via spam email (password-protected ZIP attachments impersonating banks, malicious JavaScript/Office documents, and .scr download links) and exploit kits, and per BlueLiv has at times accounted for roughly 39% of active credential-theft malware worldwide.
MITRE ATT&CK techniques used in TL-2026-0867
Collection
T1005 Data from Local System; T1119 Automated Collection
Discovery
T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1573 Encrypted Channel
Credential Access
T1110 Brute Force; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Resource Development
defense-impairment
Affected products and versions in Pony (Fareit/Siplog) Credential-Stealing Trojan and
- Microsoft — Windows
Vulnerable versions: Windows XP; Windows 7; Windows 8; Windows 10; Windows 11; Windows Server
Remediation for Pony (Fareit/Siplog) Credential-Stealing Trojan and
Immediate actions
- Block known Pony C2 domains, IPs, and gate.php URL patterns at the perimeter and DNS layer
- Hunt for the fixed IE8 User-Agent (Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)) on outbound HTTP POSTs to gate.php endpoints
- Force-reset credentials for any account whose browser/FTP/email/wallet stores may have resided on an infected host
- Isolate hosts exhibiting credential-store enumeration immediately followed by outbound binary POST
Workarounds
- Strip or quarantine password-protected ZIP and .scr attachments at the mail gateway
- Block execution from %TEMP% and user profile directories via software restriction / WDAC policy
Longer-term hardening
- Deploy EDR with behavioral detection for credential-store access, process hollowing, and self-deleting batch loaders
- Enforce email filtering that inspects password-protected archives and blocks .scr attachments
- Disable browser/FTP password autosave and adopt a managed password vault with MFA
- Apply application allow-listing to prevent execution of unsigned binaries from user-writable paths
Timeline of Pony (Fareit/Siplog) Credential-Stealing Trojan and
- Pony (Fareit/Siplog) first observed in the wild as a Windows credential stealer with integrated downloader, primarily targeting Europe and North America.
- MalwareMustDie documents a Pony campaign downloading the ZeuS/Zbot banking trojan as a second-stage payload.
- Spam campaign spoofing 'Fiserv Secure Notification' delivers a password-protected ZIP (SecureMessage_*.zip) with the password supplied in the email body.
- Source code for Pony builder/loader versions 1.9 and 2.0 leaks on underground forums, enabling widespread customization and reuse by non-developers.
- Malwarebytes researcher hasherezade publishes a detailed reverse-engineering analysis of Pony's loader and stealer behavior.
- CyberArk threat research documents Pony's two-stage RC4 exfiltration, XOR-encrypted resources, and 134 credential-harvesting functions across 100+ applications.
- ANY.RUN telemetry records continued Pony activity, with samples and gate.php C2 infrastructure observed through mid-June 2026.
- Picus Security publishes an updated analysis of the Pony/Fareit credential stealer and adds threat-library coverage for email and network infiltration.
Sources cited for Pony (Fareit/Siplog) Credential-Stealing Trojan and
- What Is Pony Malware? Analysis of the Fareit Credential Stealer
- Pony or Fareit Malware Analysis, Overview by ANY.RUN
- Malware Analysis - Pony (Guillaume Orlando)
- A Pony Hidden in Your Secret Garden (CyberArk Threat Research)
- Pony: A Breakdown of the Most Popular Malware in Credential Theft (Acunetix)
- Trojan-PWS:W32/Fareit (F-Secure description)
Detection coverage for TL-2026-0867
As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0867 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.