H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Chaes](https://attack.mitre.org/software/S0631) is a multistage information stealer written in several programming languages that collects login credentials, credit card numbers, and other financial information. [Chaes](https://attack.mitre.org/software/S0631) was first observed in 2020, and appears to primarily target victims in Brazil as well as other e-commerce customers in Latin America.(Citation: Cybereason Chaes Nov 2020)

Labels

malware

28 recorded

Relationships

uses

to Browser Session Hijacking

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Encrypted Channel

Technique

uses

to Exfiltration Over Alternative Protocol

Technique

uses

to Fileless Storage

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Input Capture

Technique

uses

Technique

uses

Technique

uses

to Malicious File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

Technique

uses

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

uses

to Spearphishing Attachment

Technique

uses

to Standard Encoding

Technique

uses

to Steal Web Session Cookie

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Template Injection

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0631

Chaes

—

Cybereason Chaes Nov 2020

https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf