Malware
wincfg
- First Reported
- Aug 16, 2026
- Latest Reported
- Aug 19, 2026
Reported Context (2)
- Loader launches a Go-based stealer (wincfg) — harvests browser credentials (bypasses Chromium app-bound encryption), crypto wallets, seed phrases, Telegram data. Researchers Link npm and RubyGems Typosquatting Campaigns to the Same Infostealer
- The embedded payload identifies itself internally as wincfg, but its symbols describe a purpose-built information stealer. Relevant package paths include: StubMaker RubyGems Campaign Uses Embedded Malware to Steal Credentials and Wallet Data
MITRE ATT&CK (9)
Products (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.