A new infostealer called SantaStealer has been launched, promoting itself on Telegram and underground forums. This malware collects sensitive data and aims to evade detection by operating in-memory, though initial samples reveal weaknesses in its design and execution.

The Russian Market has gained popularity as a cybercrime marketplace for stolen credentials, particularly after the takedown of the Genesis Market. With a majority of sold credentials recycled from existing sources, the market features a significant number of logs containing sensitive information, including SaaS and SSO credentials. The rise of new infostealers like Acreed is noted, following the disruption of the Lumma stealer, indicating a dynamic landscape in cybercrime activities.

Hackers have exploited a leaked copy of Shellter Elite, a commercial AV/EDR evasion tool, to deploy infostealer malware, marking the first misuse incident since the vendor's strict licensing model was introduced. Despite ongoing malicious activity since April, Shellter was not notified by security researchers at Elastic Security Labs, who later confirmed the misuse and developed detections for the affected version. Shellter has since released an updated version for vetted customers, excluding the one responsible for the leak.