Security Experts Sound Alarm Over Emerging ‘Gremlin Stealer’ Malware
A newly surfaced cyber threat known as Gremlin Stealer has drawn the attention of threat analysts after quietly circulating since March 2025. Unlike conventional data-harvesting malware, Gremlin Stealer is engineered with an advanced toolkit capable of siphoning off a wide range of private user data.
This malicious software aggressively targets Windows systems, where it infiltrates and extracts data from web browsers, cryptocurrency vaults, VPN clients, and even chat platforms. Analysts first uncovered mentions of it being sold on dark web marketplaces and private Telegram groups, underscoring its appeal within the cybercriminal ecosystem.
One of the malware’s standout capabilities is its ability to circumvent Google Chrome’s cookie protection layer (version 20), enabling it to seize session tokens, autofill records, login credentials, and stored credit card information with troubling ease.
Researchers from Palo Alto Networks’ Unit 42 team have been closely following the malware’s spread and evolution. Their ongoing investigation confirms that the threat actors’ claims are not exaggerated — Gremlin Stealer delivers on its promise of multi-pronged data exfiltration.
This discovery points to an increasingly sophisticated threat environment, where all-in-one infostealers like Gremlin are lowering the barrier for cybercriminals and raising the stakes for digital security.
Inside Gremlin Stealer’s Operation: How It Captures and Transfers Stolen Data
Login panel of Gremlin Stealer (Image credit: Palo Alto Networks)
Once a machine is compromised, Gremlin Stealer quietly carves out a hidden workspace within the LOCAL_APP_DATA directory. Here, it temporarily collects pilfered data in unencrypted plain text files. After accumulating sufficient information, the malware bundles the contents into a ZIP archive for exfiltration.
This archive is then uploaded to a remote command-and-control (C2) server at IP address 207.244.199[.]46. Threat actors can then access the stolen trove via an accessible web-based dashboard, showcasing the organized and user-friendly interface attackers use to browse and retrieve victim data.
The consequences for users are far-reaching. Exposed credentials open the door to account takeovers, unauthorized transactions, and full-scale identity theft. In particular, the malware’s targeting of crypto wallets highlights a strong financial incentive, likely driving the malware’s active spread.
Deconstructing Gremlin’s Data Theft Engine: A Technical View
What truly elevates the danger of Gremlin Stealer is its deliberate and advanced approach to extracting high-value financial data. From login credentials and saved payment methods to cookie data that can hijack sessions, the malware employs precise techniques to bypass protections and harvest everything it can—particularly from users’ web browsers and financial apps.
Examining the GetCookies Routine in Gremlin Stealer via dnSpy (Image credit: Palo Alto Networks)
Dissecting Gremlin Stealer’s code reveals a strategic method for evading Chrome’s enhanced cookie protection (V20). The malware uses a GetCookies function that exploits WebSocket communication to extract stored session data.
By initiating a WebSocket connection, the function sends a crafted JSON request — {"id":1,"method":"Network.getAllCookies"} — to pull every available cookie from the browser. The stolen cookies, complete with metadata such as domain, name, value, path, and expiration time, are then logged into a plain text file for later use.
In parallel, Gremlin Stealer integrates dedicated routines designed to harvest saved credit card details, targeting autofill and payment data stored across a range of browsers.
Gremlin Stealer Credit Card Extraction Routine (Image credit: Palo Alto Networks)
A deep dive into Gremlin Stealer’s internals reveals purpose-built routines aimed at decrypting and harvesting stored credit card data from infected systems.
Once the malware collects this sensitive financial information, it bundles it with other stolen assets and transmits the payload to its command server using an HTTP POST request. Captured network traffic confirms the outbound transfer, highlighting how efficiently victim data is exfiltrated.
What makes Gremlin Stealer particularly potent is its breadth of targeting. It scans for a wide array of Chromium- and Gecko-based browsers, pinpoints known cryptocurrency wallet locations, and pulls configuration files from FTP clients and VPN software—ensuring that no high-value data source is left untouched.
Fortunately, users protected by advanced threat prevention tools—such as those provided by Palo Alto Networks—benefit from behavioral analytics that can detect and block infostealers like Gremlin before any sensitive data is leaked.
