H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Pony](https://attack.mitre.org/software/S0453) is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.(Citation: Malwarebytes Pony April 2016)

Labels

malware

16 recorded

Relationships

uses

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Junk Code Insertion

Technique

uses

to Local Account

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Masquerading

Technique

uses

Technique

uses

to Password Guessing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to System Information Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

S0453

Malwarebytes Pony April 2016

https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/