PupkinStealer: A Lean .NET Malware Engineered for Precision Credential Theft
A new player in the cyber threat landscape has emerged—PupkinStealer, an infostealer crafted in C# atop the .NET framework. Rather than relying on complexity or deep obfuscation, this streamlined tool focuses on swift, targeted extraction of sensitive user information. Its scope includes browser-saved passwords, messaging session tokens, desktop-stored data, and even active screenshots—painted as a minimalist, high-impact threat.
CYFIRMA’s threat intelligence report, shared with Cyber Security News, reveals that PupkinStealer uses Telegram’s Bot API as its exfiltration backbone. This tactic illustrates a wider cybercriminal shift toward abusing trusted, mainstream services to evade detection and ensure reliable command-and-control.
Spotted in the wild as recently as April 2025, PupkinStealer stands out for its selective data harvesting. Unlike bulk collectors, it homes in on specific, high-value assets, reflecting the precision-driven strategies of modern threat actors. Telegram’s appeal among cybercriminals—offering anonymity, accessibility, and ease of integration—makes it the ideal conduit for this type of malware.
CYFIRMA’s analysis attributes the malware to a threat actor or developer using the alias “Ardent”, as identified through internal code artifacts.
Core Functional Profile of PupkinStealer
- Credential Theft: Extracts and decrypts saved login data from Chromium-based browsers, including Chrome, Edge, Vivaldi, Opera, and Opera GX.
- Session Hijacking: Mines session data from messaging platforms.
- Desktop Recon: Captures files and real-time screenshots from the victim’s machine.
- Stealthy Exfiltration: Channels stolen data via Telegram’s Bot API with no need for custom infrastructure.
- Fast Execution, Minimal Trace: Lacks persistent footholds or advanced obfuscation—favoring short-lived but effective attacks.
Inside PupkinStealer: A Tactical Breakdown of Its Data Theft Mechanics
PupkinStealer isn’t just another infostealer—it’s a purpose-built reconnaissance tool disguised as a compact Windows application, capable of silently harvesting high-value data and transmitting it through Telegram’s infrastructure.
Rather than relying on brute force or advanced stealth, PupkinStealer opts for efficiency: it extracts encryption keys directly from a browser’s Local State file, then unlocks saved passwords using the Windows Data Protection API (DPAPI). Credentials stored in SQLite-based Login Data databases—commonly used by Chromium browsers—are decrypted with precision.
Once deployed, the malware combs through the victim’s desktop environment, looking specifically for documents and media files with extensions such as .pdf, .txt, .sql, .jpg, and .png. Any matches are silently copied to a temporary directory for later transmission.
Telegram account takeover is a core capability. By copying the entire tdata directory, PupkinStealer enables attackers to hijack Telegram sessions without needing credentials or two-factor codes. Similarly, it combs Discord’s leveldb folders to extract authentication tokens using regex-based pattern matching, offering attackers full session impersonation potential.
To provide situational awareness, the malware captures a 1920×1080 screenshot of the active desktop and saves it as a .jpg. All collected assets—including login dumps, desktop files, session tokens, and the screenshot—are bundled into a ZIP archive. This package also includes system metadata: username, public IP, and Windows Security Identifier (SID), offering valuable context for attackers.
Under the Hood: Technical Anatomy
PupkinStealer is compiled as a 32-bit GUI executable (6.21 MB in size) built with the .NET framework using AnyCPU targeting, making it compatible across x86 and x64 Windows systems. The application’s structure is deceptively simple but functionally dense.
To boost portability, it uses the Costura.Fody library to embed dependent DLLs within the executable, inflating entropy in the .text section (value ~7.998)—a hallmark of embedded binaries rather than conventional packers.
When launched, the .NET runtime triggers the Main() method, initiating asynchronous threads for discrete data theft functions:
- ChromiumPasswords Module: Reads, decrypts, and exports credentials into browser-specific logs (e.g.,
Chrome.txt) stored temporarily under%TEMP%\[username]\Passwords. - Key Decryption Handlers (
FunctionsForStealer,FunctionsForDecrypt): Manage key extraction from Chromium’s Local State files and perform AES-GCM decryption on password entries. - File Harvesting (
GrabberDesktop): Identifies and copies target filetypes from the desktop, using exception suppression to avoid alerts or user disruption. - Session Token Extraction: Scans and extracts Telegram and Discord session data—Telegram’s
tdatafolder is copied recursively, while Discord tokens are scraped via regex. - Visual Recon: Captures full-HD screenshots of the desktop environment and names them systematically for inclusion in the stolen archive.
- Data Packaging: Uses maximum ZIP compression (level 9, CP866 encoding) to compact all harvested data into a single payload.
Command and Control: Telegram as a Delivery Channel
The final payload is sent to a Telegram bot under the alias botkanalchik_bot—a name that subtly hints at Russian linguistic roots (“kanal” meaning “channel”). Transmission is handled via a crafted Telegram Bot API URL, allowing attackers to receive data without hosting their own infrastructure or risking exposure via traditional servers.
Command and Control in Plain Sight: PupkinStealer’s Telegram Pipeline
Rather than leveraging complex, bespoke infrastructures, PupkinStealer opts for simplicity and speed—exfiltrating stolen data via Telegram’s Bot API. Each payload, zipped and encrypted, is sent as a message attachment to an attacker-controlled bot. The archive includes rich metadata in the caption—usernames, IP addresses, Windows SIDs, and status flags indicating the success of each data harvesting module—making it easy for attackers to triage victims at scale.
The malware contains a digital signature of sorts: the embedded attribution tag “Coded by Ardent.” According to a report from CYFIRMA, linguistic cues within the Telegram ecosystem suggest that the malware’s developer may be operating from a Russian-speaking region, though definitive attribution remains elusive.
The Rise of ‘Plug-and-Pillage’ Malware
PupkinStealer exemplifies a growing class of low-friction, plug-and-play malware designed for rapid deployment. With no advanced obfuscation, sandbox evasion, or anti-debugging routines, it appeals to less-skilled cybercriminals seeking fast ROI. This kind of tool fits neatly into malware-as-a-service (MaaS) offerings—where even novice actors can weaponize it to steal credentials, hijack sessions, and offload the results on darknet marketplaces.
Its architecture speaks to a shift in cybercrime economics: minimal effort, modular tooling, and high-value data monetization pipelines.
Defense Strategies: How to Stay Ahead of Low-Skill, High-Impact Threats
Despite its simplicity, PupkinStealer can be devastating when undetected. Here’s how organizations and individuals can mount an effective defense:
- Educate End Users: Promote vigilance around unfamiliar downloads and links—especially those tied to cracked software or suspicious “productivity tools.”
- Keep Systems Patched: Regularly update operating systems, browsers, and chat applications to close off known vulnerabilities.
- Leverage Modern AV Tools: Deploy updated antivirus and endpoint protection capable of detecting behavior-based threats, not just signature-based ones.
- Track Telegram Traffic: Monitor for outbound requests to Telegram APIs or Bot endpoints—especially in corporate environments where such traffic is unusual.
- Secure Credentials: Avoid storing passwords in browsers. Instead, use trusted password managers and enforce multi-factor authentication (MFA) on all critical platforms.
- Cultivate a Security-First Culture: Provide ongoing training on phishing, social engineering, and the evolving threat landscape to empower employees as the first line of defense.
