We identified a new malware called #HypeAgent which acts as information stealer & loader. It is dominantly spread through malspam 📧, first observed on August 1, 2026 🔭👀 Key Capabilities ⤵️ 🕵️ Stealer & Loader: Supports 200+ commands; drops/executes payloads, including crypto miners 💸 🔎 Targeted Harvesting: Steals web browser & email credentials, crypto wallets, and gaming accounts (Steam, Roblox) 🎮 🤖 AI & Platform Cookie Stealing: Targets a list of hardcoded domains like Grok, Anthropic, Coinbase, ByBit, Instagram, and Rockstar Games for which it steals session cookies 🍪 💰 Electron App Webinjects: Intercepts activity on desktop apps like Exodus Wallet 👛 Artifacts observed ⤵️ 1️⃣ Stores stealers logs under C:\Users\USERNAME\AppData\Local\Temp\hype-YYYY-MM-DD.log 2️⃣ Uses HTTP host header "X-Hype-Agent-Token" during botnet C2 communication HypeAgent communicates via WebSocket using JSON. Here are some Botnet C2 servers we have been observed ⤵️ 📡 31.40.204.178:7080 WhiteLabel 🇹🇷 📡 94.26.3.211:7443 Stellar Group SAS 🇫🇷 📡 192.109.139.91:7443 Stellar Group SAS 🇺🇸 📡 195.177.94.60:7443 Stellar Group SAS 🇫🇷 📡 107.175.148.122:7443 HostPapa 🇺🇸 📡 209.54.103.173:7443 HostPapa 🇺🇸 📡 132.243.225.173:7080 QWINS-Hosting 🇩🇪 📡 78.40.209.113:7081 QWINS-Hosting 🇫🇮 📡 31.77.138.55:5654 QWINS-Hosting 🇫🇮 🦊 Releated IOCs on ThreatFox: https://threatfox.abuse.ch/browse/tag/HypeAgent/ 📄 Releated malware samples on MalwareBazaar: https://bazaar.abuse.ch/browse/signature/HypeAgent/