StrelaStealer: New malicious infrastructure for payload delivery

ThreatFox has identified 13 new indicators of compromise (IOCs) associated with the StrelaStealer information-stealing malware. The indicators, observed on 2026-11-04, include domains and URLs primarily utilized for payload delivery. Observed patterns suggest these nodes participate in malicious web redirect chains, often involving the "fakeupdates" delivery mechanism.

Recommendation

• Block the listed domains and URLs at the organization's DNS resolver and perimeter firewall.
• Implement outbound traffic monitoring for endpoints reaching out to untrusted or newly registered domains, particularly those serving PHP content over HTTP.
• Review proxy and web logs for requests containing long, base64-encoded query parameters similar to the identified URL pattern, as these may indicate staging or C2 communication.