🕵️ ZigCryptoStealer

The items that name it 3

• The Fine Art of Frustrating the Adversary
  article2026-10-01

  Cryptocurrency stealer used as a secondary payload alongside Amatera in one of the analyzed attack chains; stored its C2 domain in the metadata of a BNB Smart Chain contract (EtherHiding technique).

• We've got one word for it, and it's usually the wrong one
  article2026-09-10

  Secondary payload delivered alongside Amatera stealer in the UAT-10820 WebDAV campaign.

• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  writeup2026-09-08