What is Fickle Stealer?

Fickle Stealer is a Rust-based Windows information stealer first reported by Fortinet in 2024. It uses multiple delivery chains and a PowerShell script that bypasses User Account Control with a mock-trusted-directory trick and reports each victim to a Telegram bot. It steals crypto wallets, browser data, Discord/Signal/Telegram data and documents including KeePass databases, driven by an RC4-encrypted target list from its C2.

Fickle Stealer: A Rust Thief That Fakes a Trusted Directory

Fickle Stealer is a Rust-based Windows information stealer first reported by Fortinet FortiGuard Labs in 2024. It stands out for heavy packing and a multi-stage delivery that leans on PowerShell both to bypass User Account Control and to report victim telemetry to a Telegram bot. The final Rust payload runs anti-analysis checks, then exfiltrates browser, wallet, messaging-app and document data as JSON to its C2, which replies with an RC4-encrypted target list that drives what is collected.

Overview & Delivery

Fortinet first observed Fickle in 2024 and published its analysis on 19 June 2024. No named actor or commercial model is confirmed; do not assume a price. Fortinet identified four delivery routes: a VBA dropper, a VBA downloader, a link downloader and an executable downloader. Several chains invoke a PowerShell script that performs the UAC bypass and drops the next stage, with a scheduled task launching a later stage roughly fifteen minutes on. T1059.001 T1059.005 T1053.005

The Mock Trusted Directory UAC Bypass

Technique

The script places a legitimate and a fake management console into system directories using a trailing-space path such as C:\Windows \System32\, so the console treats the fake file as residing in a trusted location and auto-elevates without a prompt. The fake item then opens a local URL serving a download-and-execute payload with elevated rights.

T1548.002 T1036.005

What It Steals

Cryptocurrency wallets and browser data (credentials, cookies, autofill, cards) from Chromium and Gecko browsers. T1555.003 T1539
Application data from Discord, Signal and Telegram.
Documents by extension, including .docx, .xlsx and KeePass .kdbx files. T1119
Config-driven: the C2 returns an RC4-encrypted target list; matching data is Deflate-compressed and sent as JSON. T1560 T1573.001

MITRE ATT&CK Mapping

Note

Analyst-mapped; Fickle has no official ATT&CK Software entry.

Tactic	Technique	Usage
Execution	T1059.001 PowerShell	Delivery and UAC bypass
Privilege Escalation	T1548.002 Bypass UAC	Mock trusted directory
Defense Evasion	T1036.005 Match Legitimate Name/Location	Fake console file
Persistence	T1053.005 Scheduled Task	Later-stage launch
Collection	T1560 Archive Collected Data	Deflate compression
Command and Control	T1573.001 Symmetric Cryptography	RC4 target list

Detection & Mitigation

Alert on PowerShell writing to paths with a trailing space before a backslash and creating .msc files in system directories, and on console auto-elevation without a consent prompt.
Enable PowerShell script-block and module logging and Constrained Language Mode; block macros from the internet.
Monitor outbound api.telegram.org calls carrying host and user details; set UAC to always prompt on the secure desktop.

Contain Infostealer Compromise

Mjolnir Security helps organisations detect stealer delivery chains and privilege-escalation tricks.

Threat HuntingManaged Detection & ResponseEndpoint HardeningIncident ResponseEmail Security

Endpoint Hardening Review Assessment of UAC, PowerShell logging and macro controls against multi-stage stealer delivery.
Managed Detection and Response Monitoring for mock-trusted-directory UAC bypass and Telegram telemetry egress.
24/7 Incident Response Containment and credential rotation when stealer activity is detected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026