Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Technical Analysis of Marco Stealer
Threat Actors
Malware Families
Excerpt
IntroductionZscaler ThreatLabz has discovered an information stealer that we named Marco Stealer, which was first observed in June 2025. Marco Stealer primarily targets browser data, cryptocurrency wallet information, files from popular cloud services like Dropbox and Google Drive, and other sensitive files stored on the victim’s system. Marco Stealer implements several anti-analysis techniques including string encryption and terminating security tools. The malware…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://45.74.19.20:49259/receive | High | Score 58/100 | First seen |
| URL | http://217.156.50.228:8181/nujbOqrNYyLXXLmOhPpY/PNcWncSY.exe | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…