Void Infostealer
Void Stealer: Information-Stealing Malware Targeting Credentials and Cryptocurrency Assets
Void Stealer is a Windows infostealer that emerged as part of the growing malware-as-a-service ecosystem. Designed to harvest credentials, browser cookies, cryptocurrency wallet data, authentication tokens, and other valuable information, the malware enables cybercriminals to monetize compromised accounts and digital assets. Its commercial availability and active development have made it an increasingly common threat in phishing campaigns, malicious downloads, and credential theft operations.
Introduction to Void Stealer
Like many modern information stealers, Void Stealer focuses on collecting data that can be sold, abused for account takeovers, or used in follow-on attacks. The malware is frequently promoted through underground forums and messaging platforms, where operators offer subscription-based access to the malware and its supporting infrastructure. Once installed, Void Stealer gathers information from browsers, applications, and cryptocurrency wallets before transmitting the stolen data to attacker-controlled servers.
1. How Void Stealer Works
Infection Mechanism:
Void Stealer commonly spreads through:
- Phishing emails containing malicious attachments or download links.
- Fake software installers disguised as legitimate applications.
- Cracked software, game cheats, and pirated downloads.
- Malvertising campaigns redirecting users to malware-hosting websites.
- Delivery through malware loaders and other trojan infections.
Payload Execution:
After execution, Void Stealer:
- Profiles the infected system and gathers device information.
- Extracts saved browser passwords and authentication cookies.
- Searches for cryptocurrency wallet applications and wallet files.
- Collects tokens from messaging, gaming, and cloud platforms.
- Packages stolen data and uploads it to a command-and-control (C2) server.
2. History and Notable Campaigns
Origin and Discovery:
Void Stealer emerged in the mid-2020s as a malware-as-a-service offering promoted on underground cybercrime forums. Security researchers observed its growing adoption among threat actors seeking an affordable credential theft solution with broad targeting capabilities.
Origin of the Name:
The name Void Stealer appears to originate from branding used by its operators within cybercriminal communities. As with many malware-as-a-service offerings, the name functions as both a marketing label and a way for researchers to track the malware family.
Notable Campaigns:
- Credential theft campaigns targeting browser-stored passwords and cookies.
- Operations focused on cryptocurrency wallet theft.
- Malvertising campaigns delivering malware through fake software downloads.
- Distribution through gaming communities, cracked software sites, and social engineering attacks.
3. Targets and Impact
Targeted Victims and Sectors:
- Individual users storing credentials in browsers.
- Cryptocurrency holders using desktop wallets or browser extensions.
- Gamers and users downloading unofficial software.
- Businesses whose employees become infected through phishing or malicious downloads.
Consequences:
- Theft of passwords and authentication tokens.
- Unauthorized access to online accounts.
- Loss of cryptocurrency assets.
- Identity theft and financial fraud.
- Potential use of stolen credentials in larger cyberattacks.
4. Technical Details
Payload Capabilities:
- Steals browser passwords, cookies, autofill data, and browsing information.
- Targets cryptocurrency wallets and wallet-related browser extensions.
- Collects authentication tokens from selected applications and services.
- Harvests system information and device details.
- Supports remote configuration updates from operators.
Evasion Techniques:
- Encrypted communications with command-and-control servers.
- Code obfuscation designed to hinder analysis.
- Anti-sandbox and anti-virtualization checks.
- Frequent updates that modify malware behavior and indicators.
- Use of legitimate-looking installers and software packages.
5. Preventing Void Stealer Infections
Best Practices:
- Avoid downloading software from unofficial sources.
- Be cautious when opening email attachments or clicking links.
- Use multi-factor authentication (MFA) on important accounts.
- Keep operating systems, browsers, and applications updated.
- Store credentials in a dedicated password manager rather than browser storage.
Recommended Security Tools:
- Endpoint detection and response (EDR) platforms.
- Behavior-based anti-malware solutions.
- Anti-phishing email security technologies.
- Web filtering and DNS security services.
- Threat intelligence solutions monitoring credential theft activity.
6. Detecting and Removing Void Stealer
Indicators of Compromise (IoCs):
- Unexpected outbound connections to unfamiliar servers.
- Unauthorized account access attempts.
- Unknown executables in temporary or user profile directories.
- Missing browser credentials or evidence of cookie theft.
- Security alerts related to credential exposure.
Removal Steps:
- Disconnect the affected system from the network.
- Perform a full scan using reputable anti-malware software.
- Remove all detected malware files and persistence mechanisms.
- Reset passwords for accounts accessed from the infected device.
- Review cryptocurrency wallets and financial accounts for suspicious activity.
Professional Help:
Organizations affected by large-scale credential theft should consider a formal incident response investigation to identify additional compromise and unauthorized access.
7. Response to a Void Stealer Infection
Immediate Steps:
- Disconnect the infected device from the internet.
- Change passwords using a clean, uncompromised system.
- Revoke active sessions and authentication tokens.
- Review financial and cryptocurrency accounts for suspicious activity.
- Investigate for additional malware that may have been installed.
8. Legal and Ethical Implications
Legal Considerations:
Organizations whose systems are compromised may face reporting obligations if customer, employee, or regulated data is exposed. Credential theft can also result in unauthorized access incidents that trigger compliance requirements under various privacy regulations.
Ethical Considerations:
Void Stealer exemplifies the growing commercialization of cybercrime through malware-as-a-service offerings. By providing powerful credential theft capabilities to a broad range of threat actors, such services contribute to account compromise, financial fraud, and identity theft on a global scale.
9. Resources and References
- Gen Blog: VoidStealer, Debugging Chrome to Steal Its Secrets
- SOCRadar: Void Stealer, The Infostealer Malware Quietly Targeting Organizations in 2026
- Cyber Security News: New VoidStealer Variant Bypasses Chrome ABE Without Injection or Privilege Escalation
- MITRE ATT&CK techniques related to credential access and data exfiltration.
10. FAQs about Void Stealer
Q: What is Void Stealer?
A: Void Stealer is a Windows infostealer that targets credentials, browser data, cryptocurrency wallets, and authentication tokens.
Q: How does Void Stealer spread?
A: It commonly spreads through phishing emails, fake software installers, malicious advertisements, cracked software, and malware loaders.
Q: What information does Void Stealer steal?
A: Browser passwords, cookies, authentication tokens, cryptocurrency wallet information, and other sensitive data.
Q: Is Void Stealer still active?
A: Yes. Security researchers continue to observe Void Stealer in credential theft campaigns and malware-as-a-service operations.
11. Conclusion
Void Stealer represents the latest generation of information-stealing malware designed to monetize access to digital identities and online assets. Its ability to target credentials, cryptocurrency wallets, and authentication tokens makes it a significant threat to both individuals and organizations. Maintaining strong password practices, enabling multi-factor authentication, and using modern security tools remain essential defenses against this increasingly common form of malware.
« Back to the Virus Information Library