---
title: "StealeriumPy: A Stealerium variant delivered through ClickFix"
description: Discover 'StealeriumPy,' a new malware variant exploiting ClickFix techniques to steal sensitive data and learn how to defend against it in this insightful analysis.
---

[Blogs ](https://www.cegeka.com/en/blogs)

# [StealeriumPy: A Stealerium variant delivered through ClickFix](https://www.cegeka.com/en/blogs/stealeriumpy-a-stealerium-variant-delivered-through-clickfix)

 Written by [Cristina Aldea](https://www.cegeka.com/en/blogs/author/cristina-aldea) | Jun 23, 2025 1:10:54 PM

## **Malware Overview**

In the first quarter of 2025, Cegeka CSIRT observed ‘StealeriumPy’ being distributed through ClickFix. ‘ClickFix’ is a popular social engineering technique that was first observed by security researchers in August 2024. Users accessing a suspicious or compromised website are prompted with pop-up messages that resemble ‘CAPTCHA’ or ‘IT support notifications’. These pop-up messages commonly request the users to follow instructions in order to ‘fix’ a non-existent issue or ‘prove’ that they ‘are not a robot’.

 Accessing such a website and following the instructions provided in a fake ‘CAPTCHA’ message, results in the execution of ‘StealeriumPy’. 

 Once executed, the malware injects itself into a legitimate executable and collects:

- System information: Public IP address, Operating system version, Antivirus, Country Code, Windows Key.
- Wireless network profiles and credentials.
- Browser data: Saved credentials, cookies, credit card Information, cryptocurrency wallets, history, bookmarks, extensions.
- Documents and sensitive files that reside in User folders.
- Configuration files, sessions, account metadata of gaming applications.
- Configuration files and credentials from VPN Clients.
- Session data and login credentials from messaging applications.

The collected data is then exfiltrated via HTTP to a public IP address. 

Below, a high-level overview of the infection chain can be found:

## Recommendations

Cegeka CSIRT encourages organizations to:

- Use **Endpoint Detection and Response (EDR) **tools to continuously monitor endpoints’ activity, detect and respond to threats.
- Conduct frequent **user awareness training **and raise awareness on new attacks and techniques employed by threat actors.
- Encourage users to report any suspicious activity.
- Encourage **Browser hygiene **by avoiding saving sensitive information (credentials, credit card data or personal information) within the browser.
- Consider disabling the** ‘Win + R’ shortcut** (used for Windows Run Dialog) shortcut (‘Win + R’), as ‘ClickFix’ technique seem to utilize this shortcut to coerce users into running malicious commands.
- Establish an internal** Security Operation Center** / Cybersecurity Incident Response team or partner with a Managed Security Services Provider to ensure continuous threat detection and prompt incident response.

## **Malware Analysis Report**

Please find the full Cegeka CSIRT malware analysis report along with a YARA rule for the detection/identification of StealeriumPy here:

<https://www.cegeka.com/hs/cta/wi/redirect?encryptedPayload=AVxigLK%2F3UkdTi9L9BbVDrZpTdQyMA4fjWj226lrMHfNvw5RMcLPOSH3VZppxSZnYJJXgMQtxgtmxYTkY%2FDrQbh4O%2FPkiJ03gsIrD%2BA76KkIsTvtn2Zv5%2B9wwUdkXTZXpudLK8Je4RLGjMMmfasp6CCrF2kvFSCO0iFnRjPSitpy7dSj3KS24YnsbfStNFanmwmJhTiBPPtj%2Fim5RSNiyCaI8Gvqw9pPeNfbY7DO3EEu7aJsJfy6r0oxNRWDy4CnEBoj8Nf2grZMM2kVRTNyMLx4%2FvBNkey0a5EvZTIRZuWYiW%2BUEk9jo4CWZaVqGr%2Blb228CAblDf7m&webInteractiveContentId=191559691703&portalId=2655225>

## **Cegeka Modern SOC**

Our [Cegeka Modern SOC](https://www.cegeka.com/en/solutions/cyber-security-networking/cegeka-modern-soc), staffed with experienced security professionals, is able to detect these types of attacks and adequately respond to them in a timely manner, minimizing or even fully preventing impact on your organization.

[View full post](https://www.cegeka.com/en/blogs/stealeriumpy-a-stealerium-variant-delivered-through-clickfix)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Cristina Aldea"
  },
  "dateModified" : "2025-07-23T11:32:01.313Z",
  "datePublished" : "2025-06-23T13:10:54Z",
  "headline" : "StealeriumPy: A Stealerium variant delivered through ClickFix",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1080,
    "url" : "https://2655225.fs1.hubspotusercontent-na1.net/hubfs/2655225/StealeriumPy_brochure_Blog%20featured%20images%201920x1080px.png",
    "width" : 1920
  },
  "mainEntityOfPage" : "https://www.cegeka.com/en/blogs/stealeriumpy-a-stealerium-variant-delivered-through-clickfix",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Discover our latest blogs"
  }
}
```