What is Mystic Stealer?

Mystic Stealer is a subscription malware-as-a-service information stealer first advertised in April 2023. It steals data from nearly 40 browsers, 70-plus extensions, crypto wallets and apps like Steam and Telegram, using polymorphic string obfuscation. Its original custom binary C2 over non-standard TCP ports was often blocked by corporate egress filtering, so it moved to HTTP. It also functions as a loader, delivering RedLine, DarkGate and GCleaner.

Mystic Stealer: A Custom Binary Protocol That the Enterprise Broke

Mystic Stealer is a subscription malware-as-a-service information stealer first advertised in April 2023. Written in C with a Python-based web panel, it harvests credentials and data from a broad set of browsers, extensions (notably crypto-wallet and 2FA extensions), wallets and desktop applications such as Steam and Telegram, plus system reconnaissance and screenshots. It is notable for heavy polymorphic string obfuscation — every build encrypts strings uniquely — and, originally, a custom encrypted binary command-and-control protocol over TCP that it later abandoned for HTTP.

Overview & MaaS Model

Mystic was sold as a builder plus Python panel, promoted on forums with buyer support reportedly through Telegram, at a reported price of around $150 per month or $390 for three months (Dark Reading, CYFIRMA). It drew rapid analyst attention within months of its April 2023 launch and later added loader functionality to deliver second-stage payloads.

The Custom C2, and Why It Changed

Engineering lesson

Original variants used a custom binary protocol over TCP on non-standard ports; the registration message carries a constant 4-byte value (reported as 0x946F19B5). Zscaler noted the non-standard ports were often blocked by corporate egress filtering, so beacons failed in enterprise networks — and the C2 later moved to HTTP. A claim that the protocol is RC4-encrypted comes from secondary reporting and is not confirmed against the primary analysis.

Technical Capabilities

Steals from nearly 40 browsers and more than 70 extensions, emphasising crypto-wallet and 2FA extensions. T1555.003 T1539
Crypto wallets and desktop apps including Steam and Telegram; a screenshot on first run and broad system reconnaissance at check-in. T1113 T1082
Polymorphic string obfuscation (ADVobfuscator-like); operates largely in memory — though a persistence capability was reportedly added, so it is not fileless. T1140
As a loader, it has delivered RedLine, DarkGate and GCleaner. T1105

MITRE ATT&CK Mapping

Note

Analyst-mapped; verify against any official ATT&CK Software entry before operational use.

Tactic	Technique	Usage
Defense Evasion	T1140 Deobfuscate/Decode	Polymorphic string decryption
Credential Access	T1555.003 Web Browsers	Saved logins
Credential Access	T1539 Steal Web Session Cookie	Session hijack
Collection	T1113 Screen Capture	Screenshot on first run
Command and Control	T1105 Ingress Tool Transfer	Loader stage

Detection & Mitigation

Restrict and inspect outbound traffic on non-standard TCP ports; alert on binary C2 to unusual ports and, for later variants, on stealer-typical HTTP POSTs.
EDR rules for mass browser-credential and extension-store access and screenshot APIs by unknown processes.
Treat a Mystic infection as a possible loader event — hunt for follow-on RedLine, DarkGate or GCleaner — and rotate credentials and session cookies.

Contain Infostealer Compromise

Mjolnir Security helps organisations detect stealer and loader activity and the credential theft it causes.

Threat HuntingManaged Detection & ResponseEgress MonitoringIncident ResponseCredential Exposure Monitoring

Managed Detection and Response Monitoring for anomalous C2 on non-standard ports and mass browser-store access.
Threat Hunting as a Service Hunting for loader-stage follow-on payloads such as RedLine and DarkGate.
24/7 Incident Response Containment and credential rotation when stealer activity is detected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026