THREAT OPS › Threat News › Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools
Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools
<h1>Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools</h1> <p><em>Kynx is a new Malware-as-a-Service infostealer, built in C++ with AI assistance and promoted on a Turkish game cheating forum. It targets browser credentials, 65 crypto wallet extensions, 16 gaming platforms, and 8 AI coding tools including Claude Code and Cursor.</em></p> <hr /> <p>Infostealers are a rapidly
MITRE ATT&CK techniques
- Email CollectionT1114
- Local Email CollectionT1114.001
- DatabasesT1213.006
- Browser ExtensionsT1176.001
- System ChecksT1497.001
- Automated CollectionT1119
- System Information DiscoveryT1082
- Application Layer ProtocolT1071
- Data from Local SystemT1005
- Credentials from Password StoresT1555
- Social EngineeringT1684
- Archive Collected DataT1560
- Credentials from Web BrowsersT1555.003
- Private KeysT1552.004
- Command and Scripting InterpreterT1059
- File and Directory DiscoveryT1083
- Data StagedT1074
- Virtualization/Sandbox EvasionT1497
- Web ServiceT1102
- Web ServicesT1583.006
- Exfiltration Over C2 ChannelT1041
- PowerShellT1059.001
- Web ServicesT1584.006
- CredentialsT1589.001
- Data Transfer Size LimitsT1030
- ImpersonationT1684.001
- Data from Information RepositoriesT1213
- Web ProtocolsT1071.001
- Ingress Tool TransferT1105
- Messaging ApplicationsT1213.005
- Data from Information RepositoriesAML.T0036
- Data from Local SystemAML.T0037
- Command and Scripting InterpreterAML.T0050
- ImpersonationAML.T0073
- Virtualization/Sandbox EvasionAML.T0097
Indicators of compromise
- 4f7e6f33e7e80b17f5c7f59ba45f3e32431b639b7d91c2bda1b26664788c8b8bsha256
- e888d4b089fae16a9c2ba6114d603a97f282cfdd44bcd4793ab376699f75d192sha256
- d5abe59abf73ed705aa7bba798dc417525aec110f3af48cd01c2074e763b6e21sha256
- c934a2db58a1a64ee245a7627843508c6c517fcb06ea6855d26a72b41ae6753bsha256
- e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690sha256
- f2f92ab39a60850f34b672a69ca49c805f2806ee42792ac1ffae35ff9082f1cbsha256
- ea3455c896cac54d94c14240a8a9ff2558b4c0eec7fb7a4e71dcc0f2bd1c070bsha256
- b4fcfeee3e8fba9a16cf2ed992319b92cb41077df00ddc497b0b839a9a995658sha256
- b07d2ac807376917e664529df16e2ffc2a1ef74085abe2e8fc33780fcfd14ba9sha256
- aa7d9a173ebf7375663561cad02b9151d2ef5c0811f5c1989453283737acf5easha256
- 868adce4fd9e3fce8df6b5a1d0ac7a470013f3ee17e6f4ad534cb47df81a169bsha256
- 5ee02f807c2a96a4682fc08a21ca63940fec549a766e9b37515924d1c0ba89adsha256
- 5861fb86ad5395424aad41147aa5db0735e7dbd36192192f18b22e4506cae636sha256
- 531b831af19b01b1f60574602ecb4527e10d9807a834f55a924a2e1ce25010c7sha256
- 4b29d806723adc64a06dc55fc7313e0fdbfac8430c98a10213f023aeb3b4d24esha256
- 4865e7f7d6e839bfd951400c6172a56f6b8478fca8a40cd7984e6ca592e8f123sha256
- 3e5be9467dbc542d34a355ce485709faad81d592c5a1967e7811046f6d893b7fsha256
- 3a007235a69ad33701aeb8a6075646138aeb181720cde884c320d4fefe6be66csha256
- 3507d3619e9477a209514b1498ed6f00f58bafe9714a2bd2c8655a0fe500d3d8sha256
- 260f42eea5cfea6a61c0359ae205ee286c327c655b36c63fc01e7fb48c54cd18sha256
- 18d69ae35df9231a068482e2d1b8a8fcfcc18b9425a8cfe1dbe19e4f52a204aasha256
- https://cheatglobal.com/konu/kynx-stealer-devlog-gelistirici-gunlugu.103891/url
- https://www.virustotal.com/gui/file/4f7e6f33e7e80b17f5c7f59ba45f3e32431b639b7d91c2bda1b26664788c8b8burl
- https://app.any.run/tasks/b9590ebb-8a3a-47b9-94f1-0e1ee70767c3url
- kynxdev.xyzdomain
- battle.netdomain
- api.ipify.orgdomain
Original source: https://socradar.io/blog/kynx-stealer-wallets-games-ai-tools/