Malware
BeautyStealer
- First Reported
- Nov 3, 2026
- Latest Reported
- Nov 3, 2026
Reported Context (3)
- Excel spreadsheet (.XLSM) is used as a conduit to run a VBA payload, which then decodes and executes BeautyStealer. ESET Reports Gorbag Campaigns Targeting Ukrainian Organizations With Data-Stealing Malware
- The payload, named BeautyStealer and written in C++, is Gorbag's main infostealer. It harvests cookies, stored passwords and local state from the Chrome, Edge, Opera and Firefox browsers, OpenVPN configurations from ESET Details Gorbag Infostealer Campaign Targeting Ukrainian Organizations
- The group’s toolset consists of a PowerShell reverse shell that we named Prime ReverseShell, and a C++ browser-data and file stealer that we named BeautyStealer. ESET Details Gorbag’s Cyberespionage Campaign Targeting Ukraine
CVE (1)
Malware (3)
People (1)
Threat Actors (4)
MITRE ATT&CK (21)
Products (14)
Tools (3)
Industries (4)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.