{"type":"bundle","id":"bundle--f09275dd-8bd1-5350-812a-dab826356089","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"indicator","spec_version":"2.1","id":"indicator--28dbd09b-7fdf-50b5-a9f9-c2148c814296","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.984545Z","modified":"2026-08-29T13:15:01.984545Z","name":"SIGMA: StealC / Amadey Infostealer Memory Injection and Browser Stealing","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'StealC / Amadey Infostealer Memory Injection and Browser Stealing']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.984545Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--2717dd49-d94a-5e01-b12e-bb8885b22c4b","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.984545Z","modified":"2026-08-29T13:15:01.984545Z","name":"YARA: MAL_INFOSTEALER_StealC_Amadey","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'MAL_INFOSTEALER_StealC_Amadey']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.984545Z","confidence":95},{"type":"report","spec_version":"2.1","id":"report--de4b7e5a-beca-58c3-bc4a-3beea8ed95fa","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.984545Z","modified":"2026-10-30T15:09:22.073289Z","name":"Analysis of StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them","description":"Technical threat analysis derived from intelligence published at https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/.\n\nStealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them In this article The role of infostealers: From credential theft to intrusion StealC: Infostealer for rent Amadey: Malware-as-a-service for delivery of infostealers Defending against StealC and Amadey intrusions Microsoft Defender detections Indicators of compromise Infostealers continue to be some of the most pervasive and impactful threats across the cybercrime ecosystem. They play a central role in intrusions, silently harvesting passwords, cookies, and session tokens before exfiltrating stolen data to attacker-controlled infrastructure. If not mitigated, these threats can turn a single consumer-device compromise into an enterprise risk: an infostealer infection on an employee’s pe","published":"2026-08-29T13:15:01.984545Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","indicator--28dbd09b-7fdf-50b5-a9f9-c2148c814296","indicator--2717dd49-d94a-5e01-b12e-bb8885b22c4b"],"confidence":95}]}