Threat reportMalwareTL-2026-3863
WhiteSnake Stealer - .NET infostealer sold as MaaS, exfiltrating via Telegram, Tor and HTTP
WhiteSnake Stealer (TL-2026-3863), also tracked as WhiteSnake, is a high-severity malware campaign, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Windows (endpoints running the .NET WhiteSnake stealer), maps to 16 MITRE ATT&CK techniques (T1005, T1012, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3863
- Threat ID
- TL-2026-3863
- Also known as
- WhiteSnake, WhiteSnake Stealer, WhiteSnake RAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, software-development, general-consumer
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in WhiteSnake Stealer
Malware and tooling: WhiteSnake Stealer
How WhiteSnake Stealer works
WhiteSnake is a cross-platform (.NET Windows / Python Linux) information stealer sold as Malware-as-a-Service on underground forums since February 2023. It steals browser credentials and cookies, cryptocurrency wallets and extensions, FTP and messaging data and screenshots, and exfiltrates to attacker-controlled Telegram bots, an HTTP endpoint or a Tor hidden service.
WhiteSnake Stealer was first observed in early February 2023 and advertised on underground forums as MaaS at $120/month, $900/year or $1,500 lifetime. The Windows build is a .NET (C#) executable; a Linux variant is a Python script. Cyble's initial report (24 Feb 2023) and FortiGuard's threat signal (28 Feb 2023) describe theft from Chromium-based browsers, Firefox and Edge, applications such as Steam and Telegram, cryptocurrency wallets and wallet browser extensions, with exfiltration to attacker-controlled Telegram bots. FortiGuard noted samples disguised as fake PDFs and children's games.
Cyberthint's April 2023 analysis of WhiteSnake.exe (29,196 bytes, SHA-256 a4191e00...fe9db7) documents a single-instance mutex (Iismnquexvzadgcnmtdldq), a string deobfuscation routine, WMI-based VM detection (SELECT * FROM Win32_ComputerSystem), registry and system fingerprinting, external-IP lookup via ip-api.com, screenshot capture and collection of browser credentials and session cookies, wallets, FTP client credentials and messaging application accounts. Stolen data is serialized as XML, encrypted and delivered to a Telegram bot via api.telegram.com (149.154.167.220). A Discord CDN URL hosting build.bat was listed as a malicious URL. The sample was detected by 58/70 VirusTotal engines at the time.
JFrog (April 2023) found 22 malicious PyPI packages published 14-23 April 2023 that delivered WhiteSnake through setup.py: the dropper identified the OS and executed Base64-decoded platform-specific payloads - the WhiteSnake RAT/stealer on Windows and a Python stealer on Linux. The Windows payload blacklists VM vendors (VMware, VirtualBox, KVM, Hyper-V), checks Debugger.IsAttached and loaded modules (SbieDll.dll, HTTPDebuggerBrowser.dll, FiddlerCore4.dll), XOR-obfuscates strings, copies itself to %localappdata%\NET.Framework and persists via a scheduled task running every minute. It downloads the Tor binary, writes a custom torrc with a random SOCKSPort (2000-7000) and exposes a hidden service supporting PING, UNINSTALL, REFRESH, SCREENSHOT, GET_FILE and LOADER commands. Collected data (XML, gzip, RC4 and optionally RSA) covers screenshots, hardware, processes and loaded assemblies, plus wallets (Atomic, Wasabi, Electrum, Metamask). The Linux payload uses ip-api.com, steals Firefox/Thunderbird credentials, Exodus/Electrum wallets and Telegram/Pidgin data, and posts an RC4-encrypted archive to the Telegram API.
SonicWall (18 Mar 2024) analysed a later variant with string decryption removed (far less obfuscation), adding keylogging, clipboard capture, microphone/webcam capture, Wi-Fi credential harvesting, a remote terminal, and 12+ wallets and crypto extensions (Ledger, Exodus, Monero, Metamask, Phantom, Ronin, BinanceChain, TronLink). It exfiltrates via an HTTP PUT to 45.61.137.41:8080/sendData with Base64 victim metadata and via a Telegram bot. Optional (default-off) persistence copies the binary to %AppData%\Local\RobloxSecurity\ and creates a scheduled task named WhiteSnake_Stealer running every minute; anti-VM is also default-off. Output reports are named [5 random chars]_username@computername_report.wsr.
No CVE, CVSS or actor attribution is stated in the sources; the malware is operated by multiple customers of the MaaS. Severity is analyst judgment. Note that api.telegram.com/149.154.167.220 and ip-api.com are legitimate services abused by the malware; block or alert on them only in context. A BeaconBeagle lookup for 45.61.137.41 and 149.154.167.220 returned HTTP 404 (no record).
MITRE ATT&CK techniques used in TL-2026-3863
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture
Discovery
T1012 Query Registry; T1082 System Information Discovery; T1518 Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
Initial Access
T1195.002 Compromise Software Supply Chain
Credential Access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Affected products and versions in WhiteSnake Stealer
- Microsoft — Windows (endpoints running the .NET WhiteSnake stealer)
Vulnerable versions: Not version-specific - Linux — Linux endpoints running the Python WhiteSnake payload
Vulnerable versions: Not version-specific - Python Software Foundation — PyPI (22 malicious packages, April 2023)
Vulnerable versions: Packages published 2023-04-14 to 2023-04-23
Fixed in: Packages removed from PyPI
Remediation for WhiteSnake Stealer
Immediate actions
- Hunt for the mutex Iismnquexvzadgcnmtdldq, the WhiteSnake_Stealer scheduled task, and %AppData%\Local\RobloxSecurity\ and %localappdata%\NET.Framework directories
- Alert on non-browser, non-Telegram processes connecting to api.telegram.org / api.telegram.com, and on outbound HTTP to 45.61.137.41:8080
- Reset credentials, revoke sessions/cookies and move funds from wallets on any host where WhiteSnake is confirmed
- Quarantine hosts that installed any of the listed malicious PyPI packages and rotate secrets present on them
Workarounds
- Block Discord CDN attachment downloads of .bat files from untrusted contexts
- Prevent scheduled tasks creation by standard users running every-minute tasks from user-writable paths
Longer-term hardening
- Deploy EDR with behavioral detection for browser credential-store access by unsigned .NET binaries
- Use MFA and hardware-bound/phishing-resistant sessions to reduce the value of stolen cookies
- Vet and pin third-party Python dependencies; use private mirrors or package allow-lists
- Restrict Tor client execution and Telegram API egress from servers and developer workstations where not required
Timeline of WhiteSnake Stealer
- WhiteSnake Stealer first observed in early February 2023, offered on underground forums as MaaS ($120/month, $900/year, $1,500 lifetime). Exact day not stated in sources; date is month-level.
- Cyble publishes the first public report on WhiteSnake Stealer being offered via the MaaS model (date as cited by FortiGuard).
- FortiGuard Labs releases its threat signal 'New WhiteSnake Infostealer Sold in Underground' with AV signatures W32/Stealer.WS!tr and MSIL/Agent.APA!tr.
- Cyberthint publishes malware analysis of WhiteSnake.exe with hashes, mutex, Telegram endpoint, Discord CDN build.bat URL and a YARA rule.
- Malicious PyPI packages delivering WhiteSnake begin to be published (campaign window 14-23 April 2023, 22 packages) per JFrog.
- Last of the 22 malicious WhiteSnake PyPI packages published; Windows payload used Tor C2 and a per-minute scheduled task, Linux payload exfiltrated to Telegram bots.
- SonicWall Capture Labs reports a newer, less-obfuscated WhiteSnake variant with keylogging, webcam/microphone capture, Wi-Fi harvesting and HTTP (45.61.137.41:8080) plus Telegram exfiltration.
Sources cited for WhiteSnake Stealer
- Malware Analysis: WhiteSnake Stealer (Cyberthint)
- New .NET Malware "WhiteSnake" Targets Python Developers, Uses Tor for C&C Communication (JFrog)
- WhiteSnake Stealer: Unveiling the Latest Version - Less Obfuscated, More Dangerous (SonicWall)
- New WhiteSnake Infostealer Sold in Underground (FortiGuard Threat Signal)
- New WhiteSnake Stealer Offered for Sale via MaaS Model (Cyble)
Detection coverage for TL-2026-3863
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3863 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3863
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.