Emerging Threat: “PupkinStealer” Malware Actively Draining Windows Users’ Private Data
A stealthy new cyber threat known as PupkinStealer is now circulating in the wild, posing a critical risk to Windows environments across the globe. Discovered in April 2025, this advanced malware is engineered in C# and weaponizes the .NET framework to quietly harvest sensitive user information.
At its core, PupkinStealer is designed to breach Chromium-based browsers like Chrome, Edge, Opera, and Vivaldi. By leveraging local encryption keys and abusing the Windows Data Protection API (DPAPI), it can extract saved login credentials without alerting the user.
Distribution is deceptively simple yet effective—relying on classic social engineering traps. Victims are lured into executing unsigned binaries disguised as legitimate files, delivered through phishing campaigns, compromised links, or malicious direct messages on chat platforms.
Once installed, PupkinStealer operates covertly, extracting:
- Browser passwords
- Telegram session data
- Discord authentication tokens
- Desktop documents with targeted extensions (.pdf, .txt, .sql, .jpg, .png)
- Full desktop screenshots
Rather than deploying conventional command-and-control servers, the malware exfiltrates collected data by compressing it into a ZIP file named [Username]@ardent.zip and uploading it via Telegram’s Bot API. This strategy enables it to blend in with normal encrypted traffic, eluding many standard intrusion detection systems.
Notably, PupkinStealer doesn’t establish persistence on infected systems, making it a hit-and-run style threat. Its lack of lingering presence is offset by its precision targeting and deep data access. For both individual users and enterprises, the malware represents a serious privacy and account security concern.
Code artifacts suggest the malware may be the work of an individual or group operating under the alias “Ardent.”
Why It Matters:
PupkinStealer is scored at 6.5/10 (Elevated) for threat severity, due to its effective credential scraping and ability to hijack messaging sessions. These capabilities open the door for further compromise, including impersonation attacks and internal phishing schemes.
Deep Dive: How Data Gets Out
The malware organizes stolen information into categorized subfolders under a temporary directory:
css
%APPDATA%\Temp[Username]\
├── browsers\
├── telegram\
├── discord\
└── screenshots\
It then employs asynchronous techniques to collect and compress this data swiftly. The final payload is sent via a crafted HTTP POST request to Telegram’s bot infrastructure:
bash
https://api.telegram.org/bot/sendDocument?chat_id=&caption=
By piggybacking on Telegram’s trusted and encrypted API, PupkinStealer evades conventional detection systems, which are typically tuned to flag suspicious external traffic rather than legitimate platform APIs.
