Gremlin Stealer Hides Payloads in .NET Resources to Evade Detection

Gbhackers •Mayura Kathir • May 18, 2026

A newly discovered variant of the Gremlin Stealer is raising concerns among security researchers by adopting stealth-focused techniques that significantly reduce its detection footprint. Gremlin Stealer is an information-stealing malware actively sold on Telegram. It targets a wide range of sensitive data from infected systems, including payment card details, browser cookies, session tokens, cryptocurrency wallets, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Gremlin Stealer Variant Uses Encrypted Resources for Stealthy Data Theft A new variant of the Gremlin stealer malware has emerged, utilizing advanced obfuscation techniques to hide its command-and-control infrastructure and data exfiltration methods within encrypted .NET resource sections. This malware targets sensitive information such as browser-stored credentials, session tokens, and cryptocurrency wallets. The Gremlin stealer is actively sold on Telegram, indicating a growing market for such infostealer tools. Security researchers have noted a significant reduction in detection rates due to these stealth-focused techniques. The malware's modularity and anti-analysis capabilities represent a concerning evolution in infostealer campaigns. As of now, there are no specific CVEs associated with this variant, but its impact on affected systems is expected to be substantial. 3 sources 59

Gremlin Stealer Hides Payloads in .NET Resources to Evade Detection

The full story

Extracted Entities

Attack Types (1)

Malware (1)