Threat intelligence / Malware

StrelaStealer

[StrelaStealer](https://attack.mitre.org/software/S1183) is an information stealer malware variant first identified in November 2022 and active through late 2024. [StrelaStealer](https://attack.mitre.org/software/S1183) focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.(Citation: DCSO StrelaStealer 2022)(Citation: PaloAlto StrelaStealer 2024)(Citation: Fortgale StrelaStealer 2023)(Citation: IBM StrelaStealer 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[StrelaStealer](https://attack.mitre.org/software/S1183) is an information stealer malware variant first identified in November 2022 and active through late 2024. [StrelaStealer](https://attack.mitre.org/software/S1183) focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.(Citation: DCSO StrelaStealer 2022)(Citation: PaloAlto StrelaStealer 2024)(Citation: Fortgale StrelaStealer 2023)(Citation: IBM StrelaStealer 2024)

Labels

malware

34 recorded

Relationships

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

to Code Signing

Technique

uses

Technique

uses

to Credentials In Files

Technique

uses

to Credentials in Registry

Technique

uses

to Data Obfuscation

Technique

uses

to Debugger Evasion

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Junk Code Insertion

Technique

uses

to Malicious File

Technique

uses

to Masquerade File Type

Technique

uses

to Masquerading

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mutual Exclusion

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Rename Legitimate Utilities

Technique

uses

Technique

uses

to Software Discovery

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

5 external

References

mitre-attack

S1183

PaloAlto StrelaStealer 2024

https://unit42.paloaltonetworks.com/strelastealer-campaign/

DCSO StrelaStealer 2022

https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc

Fortgale StrelaStealer 2023

https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/

IBM StrelaStealer 2024

https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/