Stealerium Malware Snaps Webcam Photos, Steals Data in Sextortion Campaigns

A new form of infostealer malware called Stealerium, available as free open-source code on GitHub since 2022, has increasingly been used by cybercriminals to automate sextortion attacks by capturing webcam photos and screenshots when victims visit adult content sites. This malware, which spreads through phishing emails with malicious attachments or links, monitors browser activity for keywords like "sex" and "porn" and then takes images from the victim's screen and webcam to blackmail them. Researchers at Proofpoint have observed a rapid rise in Stealerium's deployment since May 2023, including modifications by hackers to enhance its stealth and data-stealing capabilities, such as capturing login credentials, payment details, and cryptocurrency wallet information. Sextortion demands linked to such attacks have ranged widely, with some attackers reportedly profiting significantly from ransom payments made in cryptocurrencies, according to cybersecurity experts. The developer of Stealerium, claiming educational use, has raised ethical concerns due to the malware's misuse in cybercriminal campaigns, emphasizing the privacy invasion and distress caused by automated webcam hijacking. Security firms advise vigilance for signs of infection, including suspicious PowerShell activity and network behavior, to protect against this evolving threat.