What is Phemedrone Stealer?

Phemedrone Stealer is an open-source C#/.NET Windows information stealer. It became prominent in January 2024 when Trend Micro documented a campaign exploiting CVE-2023-36025, a Windows SmartScreen and Mark-of-the-Web bypass, to deliver it while evading warnings. It steals browser data, crypto wallets, password managers (LastPass, KeePass, NordPass) and authenticator-app data, exfiltrating via Telegram. The vulnerability is on CISA's Known Exploited Vulnerabilities list.

Phemedrone Stealer: An Open-Source Thief That Rode a SmartScreen Zero-Day

Phemedrone Stealer is an open-source, C#/.NET Windows information stealer maintained on GitHub and Telegram. It gained prominence in January 2024 when Trend Micro documented a campaign exploiting CVE-2023-36025, a Windows SmartScreen and Mark-of-the-Web bypass (CVSS 8.8, patched by Microsoft in November 2023 and added to CISA’s Known Exploited Vulnerabilities catalog), to deliver the stealer while evading SmartScreen warnings. It harvests browsers, crypto wallets, password managers, authenticator-app data and messaging apps, exfiltrating via Telegram or an attacker C2.

Overview

Phemedrone is open source rather than a paid service, so it has many derivative builds and is used by unrelated actors; there is no subscription price. The January 2024 Trend Micro campaign is its primary documented use.

The CVE-2023-36025 Chain

Delivery

A victim opens a malicious internet shortcut (.url) hosted on Discord or cloud storage. The shortcut exploits CVE-2023-36025 so the SmartScreen and Mark-of-the-Web prompt is not shown. It downloads and executes a Control Panel item (.cpl), which Windows runs via rundll32.exe, loading a malicious DLL that decrypts and loads the Phemedrone payload.

T1553.005 T1204.002 T1218.011 T1574.002

What It Steals

Browser credentials, cookies, autofill and card data. T1555.003
Cryptocurrency wallets. T1005
Password managers including LastPass, KeePass and NordPass. T1555
Authenticator-app data including Google Authenticator, Duo Mobile and Microsoft Authenticator, plus messaging apps and system information.
Exfiltration via the Telegram API or an attacker C2. T1567

MITRE ATT&CK Mapping

Note

Analyst-mapped; Phemedrone has no official ATT&CK Software entry.

Tactic	Technique	Usage
Defense Evasion	T1553.005 Mark-of-the-Web Bypass	CVE-2023-36025
Resource Development	T1588.006 Vulnerabilities	CVE-2023-36025
Execution	T1204.002 Malicious File	Opening the .url
Defense Evasion	T1218.011 Rundll32	Running the .cpl
Credential Access	T1555 Password Stores	LastPass, KeePass, NordPass
Exfiltration	T1567 Over Web Service	Telegram

Detection & Mitigation

Patch CVE-2023-36025 — it is CISA-KEV-listed, so prioritise it.
Block or inspect .url, .cpl and .lnk files from internet zones; enforce Mark-of-the-Web and SmartScreen.
Apply attack-surface-reduction rules blocking rundll32 and control.exe from launching unsigned DLLs; monitor api.telegram.org egress.

Close the Delivery Gap

Mjolnir Security helps organisations patch exploited vulnerabilities and detect the stealers that ride them.

Vulnerability ManagementThreat HuntingManaged Detection & ResponseIncident ResponseEndpoint Hardening

Vulnerability and Patch Prioritisation Focus on actively exploited, CISA-KEV-listed flaws like CVE-2023-36025 before they are weaponised.
Managed Detection and Response Monitoring for Mark-of-the-Web bypass chains and rundll32 .cpl abuse.
24/7 Incident Response Containment and credential rotation when stealer activity is detected. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026