Kynx Stealer: MaaS Infostealer Targeting Crypto Wallets, Gaming Platforms, and AI Coding Tools
Kynx Stealer (TL-2026-1943) is a critical-severity malware campaign, first published 2026-08-08. It has no confirmed attribution, affects Google Chrome / Chromium-based browsers (App-Bound Encryption), maps to 15 MITRE ATT&CK techniques (T1005, T1057, T1059.001), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-1943
- Threat ID
- TL-2026-1943
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-08
- Last reviewed
- 2026-08-08
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- individuals, cryptocurrency, gaming, software-development
- Target regions
- turkey, Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Kynx Stealer
Malware and tooling: Kynx Stealer, Chrome Elevator (CE), DBS (Dump Browser Secrets), MCE (Modified Chrome Elevator)
Kynx is a C++ Malware-as-a-Service infostealer promoted since January 2026 on the Turkish cracking/cheating marketplace cheatglobal[.]com under tiered Free/Plus/Pro/Ultra subscriptions. It bypasses Chromium's App-Bound Encryption via a four-method fallback chain (MCE/DBS/Chrome Elevator/raw copy) to steal browser credentials and cookies, targets 65 crypto wallet extensions plus 19 desktop wallets, 16 gaming platforms, 8 AI coding tools (Claude Code, Cursor, GitHub Copilot, Windsurf, Codeium, VS Code, ChatGPT/Codex), Discord tokens (after disabling DiscordTokenProtector/BetterDiscord), and email/FTP/VPN credentials, running a penalty-point anti-analysis/anti-VM gate before exfiltrating chunked data over token-authenticated HTTP to a live C2 at kynxdev[.]xyz.
How Kynx Stealer works
Kynx Stealer is a C++ infostealer operated as Malware-as-a-Service (MaaS) by a threat actor using the CheatGlobal forum handle "kakayiyenfatali" (Discord handle: antxchris), first documented via a January 2026 forum post on cheatglobal[.]com, a Turkish-centric marketplace for game cheats/mods and cracked software. SOCRadar's Threat Research Unit (STRU) analyzed a binary compiled June 3, 2026 and published its findings on August 7, 2026, rating the threat CRITICAL.
On execution, Kynx displays a deceptive "System update" banner with an animated fake terminal ("Downloading required files"), consistent with distribution via cracked software installers or ClickFix-style social engineering. Before any credential harvesting, it runs a penalty-point anti-analysis gate: PEB-based debugger detection (+10), CPUID hypervisor presence (+2), GetTickCount64 sandbox-timing checks (+2), fewer than 2 CPU cores (+1), and less than 4GB RAM (+1) — execution aborts if the score reaches 3. It separately enumerates 40+ reverse-engineering/analysis tools (x64dbg, IDA, Wireshark, Ghidra, Burp Suite, etc.) and 15+ endpoint-security products (Windows Defender, Kaspersky, Norton, Malwarebytes, etc.) running on the host.
Browser credential theft uses a four-method fallback cascade to defeat Chromium's App-Bound Encryption (ABE): (1) MCE ("Modified Chrome Elevator", mce.exe) fetched from the C2 and run with "--kill -o [TempDir] all", using in-memory techniques to kill browser processes and extract secrets within a 90-second window; (2) DBS ("Dump Browser Secrets", dbs.exe) run with "/b:all /e:all /spoof", using Parent Process ID spoofing to retrieve ABE keys, 60-second timeout; (3) the original Chrome Elevator (CE) tool with the same arguments as MCE, 45-second timeout; (4) a raw copy of the encrypted Login Data/Cookies SQLite databases for offline decryption if all tools fail. Success is confirmed by the presence of Data.json/EncPack-* artifacts.
Cryptocurrency targeting spans 19 desktop wallet applications (Bitcoin Core, Ethereum, Exodus, Electrum, Monero, Atomic Wallet, Coinomi, Guarda, Wasabi, Daedalus, Dash Core, Dogecoin Core, Litecoin Core, Jaxx Liberty, Bytecoin, MultiBit, Zcash, Binance, Armory) and 65 browser-extension wallets (MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Binance Chain Wallet, Keplr, OKX Wallet, Rabby, Rainbow, Ledger Live Web, and 55 more). It also regex-scans Desktop/Documents/Downloads for seed-phrase/private-key material using the pattern "(seed|mnemonic|private.?key|wallet.?recovery|12.?words|24.?words|phrase|metamask|ledger)".
Gaming-platform theft covers 16 platforms — Steam (loginusers.vdf, ssfn files, account JSON), Roblox (.ROBLOSECURITY cookie and robloxcookies.dat, decrypted via a hidden "powershell -NoProfile -WindowStyle Hidden -Command" invocation of DPAPI), Minecraft (launcher_profiles.json, screenshots), Battle.net, Epic Games, Lunar Client, Feather Client, CraftRise, TLauncher, AesirMC, NationsGlory, Baso Network, SonOyuncu, Modrinth, PrismLauncher, and Growtopia.
Discord theft actively disables local anti-theft protections — overwriting index.js with default code, deleting ProtectionPayload.dll and secure.dat (DiscordTokenProtector), and removing BetterDiscord archives — before extracting standard and MFA tokens from Local State/leveldb via regex, then querying /api/v9/users/@me, /api/v9/users/@me/billing/payment-sources, /api/v9/users/@me/guilds, and /api/v9/users/@me/relationships. It also harvests session cookies for Instagram (sessionid), TikTok (sessionid/sid_tt), Twitter/X (auth_token), YouTube/Google (SAPISID/__Secure-3PSID), Spotify (sp_dc), and Riot Games (RIOTGAMES_AFFINITY).
Email/FTP/VPN targeting covers Thunderbird (key4.db, cert9.db, logins.json, prefs.js), Outlook (.ost/.pst), Mailbird (Store.db), FileZilla (recentservers.xml, sitemanager.xml), and 9 VPN clients (NordVPN, ExpressVPN, ProtonVPN, Mullvad, OpenVPN, Private Internet Access, Windscribe, Surfshark, CyberGhost).
A "DevGrabber" module targets 8 AI coding tools: Claude Code, ChatGPT/OpenAI local files, GitHub Copilot (vscode_state.vscdb), Cursor (global_state.vscdb/state.vscdb SQLite), Windsurf (globalStorage), Codex, VS Code (ms-vscode-remote/github.vscode state), and Codeium.
Exfiltration uses a "ChunkSender" module that POSTs categorized data chunks (meta, sysinfo, passwords, cookies, cards, autofills, history, discord, sessions, wallets, games, steam, and a kynx_files.zip files chunk) to kynxdev[.]xyz/api/v1/ingest.php?cat={category}. Requests carry a single-use, 5-minute-validity X-Kynx-Token header (replay protection; invalid tokens trigger a permanent IP ban) and an X-Owner-ID header distinguishing which MaaS operator a given infection belongs to. An initial meta chunk returns a UUID used to correlate subsequent chunks for that victim.
SOCRadar STRU authored a detection YARA rule (dated 2026-07-17) matching on the C2 header (X-Kynx-Token, ?cat=files), file artifacts (kynx_vmcheck.txt, kynx_files.zip, kynx_early.txt, som_helper.exe, crdecrypt.exe, debug.txt), and behavioral strings ("=== KYNX STARTED (OWNER_UID=", "DevGrabber", "KynxCR_", "KynxSO_", "Priority: MCE -> DBS -> ChromeElevator -> raw copy", "[!] Being Debugged (PEB):", "WinSysHealth").
Attribution: the operator uses the CheatGlobal handle kakayiyenfatali and Discord handle antxchris, and holds "Legendary Member" status with 4,300+ forum posts; the actor has stated they used Google Gemini to assist Kynx's development. No nation-state sponsorship is indicated — this reads as a financially motivated individual/small-group MaaS operation monetized through tiered subscriptions (Free/Plus/Pro/Ultra, Ultra gated behind an invite code).
MITRE ATT&CK techniques used in TL-2026-1943
Collection
T1005 Data from Local System; T1114.001 Email Collection: Local Email Collection; T1560 Archive Collected Data
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery
Execution
T1059.001 Command and Scripting Interpreter: PowerShell
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Defense Evasion
T1497.001 Virtualization/Sandbox Evasion: System Checks; T1497.003 Time Based Checks; T1622 Debugger Evasion
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
defense-impairment
Affected products and versions in Kynx Stealer
- Google — Chrome / Chromium-based browsers (App-Bound Encryption)
Vulnerable versions: all versions relying on ABE alone, without process/behavioral monitoring - Discord Inc. — Discord desktop client
Vulnerable versions: all versions using default local token storage / third-party protectors such as DiscordTokenProtector and BetterDiscord - Multiple — Cryptocurrency browser-extension and desktop wallets (65 extensions incl. MetaMask, Phantom, Trust Wallet, Coinbase Wallet; 19 desktop apps incl. Bitcoin Core, Electrum, Exodus)
Vulnerable versions: all - Multiple — Gaming platform clients (16 total: Steam, Roblox, Minecraft, Battle.net, Epic Games, Lunar Client, Feather Client, CraftRise, TLauncher, AesirMC, NationsGlory, Baso Network, SonOyuncu, Modrinth, PrismLauncher, Growtopia)
Vulnerable versions: all - Multiple — AI coding tools (Claude Code, Cursor, GitHub Copilot, Windsurf, Codeium, VS Code, ChatGPT/Codex desktop apps)
Vulnerable versions: all
Remediation for Kynx Stealer
Patches
- No CVE or vendor patch applies — Kynx is malware, not a software vulnerability; mitigation is detection- and behavior-based (see immediate/long_term).
Immediate actions
- Block kynxdev.xyz and its paths (/payloads/mce.exe, /payloads/dbs.exe, /payloads/chromelevator.exe, /api/v1/ingest.php) at DNS/proxy/firewall.
- Hunt endpoints for the SOCRadar Kynx_Stealer YARA rule matches and the listed file/behavioral artifacts (kynx_vmcheck.txt, kynx_files.zip, kynx_early.txt, som_helper.exe, crdecrypt.exe, WinSysHealth-* staging directories, the DevGrabber string).
- Force credential rotation and session revocation on any host with detections, prioritizing Discord, crypto-wallet, and AI-coding-tool (Claude Code, Cursor, GitHub Copilot, Windsurf, Codeium) sessions.
- Revoke and reissue Discord tokens on affected accounts and verify DiscordTokenProtector/BetterDiscord protections are intact, since Kynx explicitly deletes/disables them (ProtectionPayload.dll, secure.dat).
Workarounds
- Application allow-listing (AppLocker/WDAC) to block execution of unsigned helper binaries staged in %TEMP%\WinSysHealth-* directories.
- Require hardware security keys instead of password/cookie sessions for Discord, exchange, and AI-tool accounts where supported.
Longer-term hardening
- Deploy EDR/behavioral detection tuned to Chromium App-Bound Encryption bypass patterns (browser-process termination followed by short-lived helper-binary execution, Parent Process ID spoofing, raw SQLite Login Data/Cookies access) rather than relying on ABE alone.
- Restrict and monitor downloads/execution of cracked software and game cheats from marketplaces such as cheatglobal[.]com.
- User awareness training on fake "System update" / ClickFix-style execution lures.
- Enforce hardware-backed session binding (FIDO2/passkeys) for high-value accounts — crypto exchanges, Discord, AI coding-tool accounts — to reduce the value of stolen session cookies/tokens.
Timeline of Kynx Stealer
- Google ships Chrome 127 with App-Bound Encryption (ABE) on Windows, the cookie/credential protection Kynx's MCE/DBS/Chrome-Elevator fallback cascade is purpose-built to defeat.
- CheatGlobal forum account 'kakayiyenfatali' (the actor who later promotes Kynx) is registered on the cheatglobal[.]com marketplace.
- Researcher Alexander Hagenah publicly releases the 'Chrome-App-Bound-Encryption-Decryption' PoC on GitHub, decrypting ABE-protected keys via Chrome's internal COM-based IElevator service — the technique lineage Kynx's 'Chrome Elevator' (CE) fallback tool is named after and built on.
- First documented promotion of Kynx Stealer, via a January 2026 forum post on cheatglobal[.]com advertising the Free/Plus/Pro/Ultra subscription tiers and referencing a 'prior version 2.0,' indicating undocumented earlier development.
- SOCRadar's Threat Research Unit (STRU) obtains and analyzes a Kynx binary compiled on this date (SHA256 4f7e6f33e7e80b17f5c7f59ba45f3e32431b639b7d91c2bda1b26664788c8b8b).
- SOCRadar STRU authors a YARA detection rule (Kynx_Stealer) matching Kynx's network headers, file artifacts, and behavioral strings.
- SOCRadar publishes 'Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools,' publicly disclosing the malware, its C2 (kynxdev[.]xyz), and 16 hash-identified binaries, rating it CRITICAL.
Sources cited for Kynx Stealer
- Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools
- New tool bypasses Google Chrome's new cookie encryption system
- Google Chrome Adds App-Bound Encryption to Protect Cookies from Malware
- Stealers evolve to bypass Google Chrome's new app-bound encryption
- C4 Bomb: Blowing Up Chrome's AppBound Cookie Encryption
- Chrome-App-Bound-Encryption-Decryption
- Chrome-App-Bound-Encryption-Bypass
- CheatGlobal — Free Cheats, Game Hacks, Spoofer & Bots (Kynx distribution marketplace)
Threats related to Kynx Stealer
- PawsRunner Steganography Loader Delivers Evolved .NET PureLogs Infostealer
- TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Repos
- Evolution of Remote Access Tool (RAT/RMM) Abuse: Multi-Stage Chaining of ConnectWise, GoTo, Datto, SimpleHelp, N-able, and Heartbeat RM
- CloudZ RAT with Pheno Plugin Hijacks Microsoft Phone Link to Steal SMS and OTPs (Cisco Talos, 2026-05)
Detection coverage for TL-2026-1943
As of 2026-08-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1943 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1943
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.