# Kynx Stealer: MaaS Infostealer Targeting Crypto Wallets, Gaming Platforms, and AI Coding Tools

> Kynx is a C++ Malware-as-a-Service infostealer promoted since January 2026 on the Turkish cracking/cheating marketplace cheatglobal[.]com under tiered Free/Plus/Pro/Ultra subscriptions. It bypasses Chromium's App-Bound Encryption via a four-method fallback chain (MCE/DBS/Chrome Elevator/raw copy) to steal browser credentials and cookies, targets 65 crypto wallet extensions plus 19 desktop wallets, 16 gaming platforms, 8 AI coding tools (Claude Code, Cursor, GitHub Copilot, Windsurf, Codeium, VS Code, ChatGPT/Codex), Discord tokens (after disabling DiscordTokenProtector/BetterDiscord), and email/FTP/VPN credentials, running a penalty-point anti-analysis/anti-VM gate before exfiltrating chunked data over token-authenticated HTTP to a live C2 at kynxdev[.]xyz.

- **Published:** 2026-08-08T00:00:00Z
- **Last reviewed:** 2026-08-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1943
- **ID:** TL-2026-1943
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kynx Stealer is a C++ infostealer operated as Malware-as-a-Service (MaaS) by a threat actor using the CheatGlobal forum handle "kakayiyenfatali" (Discord handle: antxchris), first documented via a January 2026 forum post on cheatglobal[.]com, a Turkish-centric marketplace for game cheats/mods and cracked software. SOCRadar's Threat Research Unit (STRU) analyzed a binary compiled June 3, 2026 and published its findings on August 7, 2026, rating the threat CRITICAL.

On execution, Kynx displays a deceptive "System update" banner with an animated fake terminal ("Downloading required files"), consistent with distribution via cracked software installers or ClickFix-style social engineering. Before any credential harvesting, it runs a penalty-point anti-analysis gate: PEB-based debugger detection (+10), CPUID hypervisor presence (+2), GetTickCount64 sandbox-timing checks (+2), fewer than 2 CPU cores (+1), and less than 4GB RAM (+1) — execution aborts if the score reaches 3. It separately enumerates 40+ reverse-engineering/analysis tools (x64dbg, IDA, Wireshark, Ghidra, Burp Suite, etc.) and 15+ endpoint-security products (Windows Defender, Kaspersky, Norton, Malwarebytes, etc.) running on the host.

Browser credential theft uses a four-method fallback cascade to defeat Chromium's App-Bound Encryption (ABE): (1) MCE ("Modified Chrome Elevator", mce.exe) fetched from the C2 and run with "--kill -o [TempDir] all", using in-memory techniques to kill browser processes and extract secrets within a 90-second window; (2) DBS ("Dump Browser Secrets", dbs.exe) run with "/b:all /e:all /spoof", using Parent Process ID spoofing to retrieve ABE keys, 60-second timeout; (3) the original Chrome Elevator (CE) tool with the same arguments as MCE, 45-second timeout; (4) a raw copy of the encrypted Login Data/Cookies SQLite databases for offline decryption if all tools fail. Success is confirmed by the presence of Data.json/EncPack-* artifacts.

Cryptocurrency targeting spans 19 desktop wallet applications (Bitcoin Core, Ethereum, Exodus, Electrum, Monero, Atomic Wallet, Coinomi, Guarda, Wasabi, Daedalus, Dash Core, Dogecoin Core, Litecoin Core, Jaxx Liberty, Bytecoin, MultiBit, Zcash, Binance, Armory) and 65 browser-extension wallets (MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Binance Chain Wallet, Keplr, OKX Wallet, Rabby, Rainbow, Ledger Live Web, and 55 more). It also regex-scans Desktop/Documents/Downloads for seed-phrase/private-key material using the pattern "(seed|mnemonic|private.?key|wallet.?recovery|12.?words|24.?words|phrase|metamask|ledger)".

Gaming-platform theft covers 16 platforms — Steam (loginusers.vdf, ssfn files, account JSON), Roblox (.ROBLOSECURITY cookie and robloxcookies.dat, decrypted via a hidden "powershell -NoProfile -WindowStyle Hidden -Command" invocation of DPAPI), Minecraft (launcher_profiles.json, screenshots), Battle.net, Epic Games, Lunar Client, Feather Client, CraftRise, TLauncher, AesirMC, NationsGlory, Baso Network, SonOyuncu, Modrinth, PrismLauncher, and Growtopia.

Discord theft actively disables local anti-theft protections — overwriting index.js with default code, deleting ProtectionPayload.dll and secure.dat (DiscordTokenProtector), and removing BetterDiscord archives — before extracting standard and MFA tokens from Local State/leveldb via regex, then querying /api/v9/users/@me, /api/v9/users/@me/billing/payment-sources, /api/v9/users/@me/guilds, and /api/v9/users/@me/relationships. It also harvests session cookies for Instagram (sessionid), TikTok (sessionid/sid_tt), Twitter/X (auth_token), YouTube/Google (SAPISID/__Secure-3PSID), Spotify (sp_dc), and Riot Games (RIOTGAMES_AFFINITY).

Email/FTP/VPN targeting covers Thunderbird (key4.db, cert9.db, logins.json, prefs.js), Outlook (.ost/.pst), Mailbird (Store.db), FileZilla (recentservers.xml, sitemanager.xml), and 9 VPN clients (NordVPN, ExpressVPN, ProtonVPN, Mullvad, OpenVPN, Private Internet Access, Windscribe, Surfshark, CyberGhost).

A "DevGrabber" module targets 8 AI coding tools: Claude Code, ChatGPT/OpenAI local files, GitHub Copilot (vscode_state.vscdb), Cursor (global_state.vscdb/state.vscdb SQLite), Windsurf (globalStorage), Codex, VS Code (ms-vscode-remote/github.vscode state), and Codeium.

Exfiltration uses a "ChunkSender" module that POSTs categorized data chunks (meta, sysinfo, passwords, cookies, cards, autofills, history, discord, sessions, wallets, games, steam, and a kynx_files.zip files chunk) to kynxdev[.]xyz/api/v1/ingest.php?cat={category}. Requests carry a single-use, 5-minute-validity X-Kynx-Token header (replay protection; invalid tokens trigger a permanent IP ban) and an X-Owner-ID header distinguishing which MaaS operator a given infection belongs to. An initial meta chunk returns a UUID used to correlate subsequent chunks for that victim.

SOCRadar STRU authored a detection YARA rule (dated 2026-07-17) matching on the C2 header (X-Kynx-Token, ?cat=files), file artifacts (kynx_vmcheck.txt, kynx_files.zip, kynx_early.txt, som_helper.exe, crdecrypt.exe, debug.txt), and behavioral strings ("=== KYNX STARTED (OWNER_UID=", "DevGrabber", "KynxCR_", "KynxSO_", "Priority: MCE -> DBS -> ChromeElevator -> raw copy", "[!] Being Debugged (PEB):", "WinSysHealth").

Attribution: the operator uses the CheatGlobal handle kakayiyenfatali and Discord handle antxchris, and holds "Legendary Member" status with 4,300+ forum posts; the actor has stated they used Google Gemini to assist Kynx's development. No nation-state sponsorship is indicated — this reads as a financially motivated individual/small-group MaaS operation monetized through tiered subscriptions (Free/Plus/Pro/Ultra, Ultra gated behind an invite code).

## MITRE ATT&CK

- T1059.001 Command and Scripting Interpreter: PowerShell
- T1622 Debugger Evasion
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1497.003 Time Based Checks
- T1685 Disable or Modify Tools
- T1057 Process Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1082 System Information Discovery
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1114.001 Email Collection: Local Email Collection
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols

## Sources

- [Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools](https://socradar.io/blog/kynx-stealer-wallets-games-ai-tools/)
- [New tool bypasses Google Chrome's new cookie encryption system](https://www.bleepingcomputer.com/news/security/new-tool-bypasses-google-chromes-new-cookie-encryption-system/)
- [Google Chrome Adds App-Bound Encryption to Protect Cookies from Malware](https://thehackernews.com/2024/08/google-chrome-adds-app-bound-encryption.html)
- [Stealers evolve to bypass Google Chrome's new app-bound encryption](https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/)
- [C4 Bomb: Blowing Up Chrome's AppBound Cookie Encryption](https://www.cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption)
- [Chrome-App-Bound-Encryption-Decryption](https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption)
- [Chrome-App-Bound-Encryption-Bypass](https://github.com/00nx/Chrome-App-Bound-Encryption-Bypass)
- [CheatGlobal — Free Cheats, Game Hacks, Spoofer & Bots (Kynx distribution marketplace)](https://cheatglobal.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1943