MetaStealer

ATP Sandbox Adv. HeuristicsNetskope IPS

Stats

First seen: April 2022
Last seen: October 2026

Also known as

MetaMetastealer

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Spyware.Metastealer	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.MetaStealer	ATP Sandbox Adv. Heuristics
Document-HTML.Downloader.Meta	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.MetaStealer	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Metastealer	ATP Sandbox Adv. Heuristics
Win32.Spyware.Metastealer	ATP Sandbox Adv. Heuristics
Win32.Trojan.Metastealer	ATP Sandbox Adv. Heuristics
Win32.Trojan.MetaStealer	ATP Sandbox Adv. Heuristics
Win64.Trojan.MetaStealer	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Generic.Meta.Phishing Kit Response detected	IPS-SWG
MALWARE-CNC Metastealer traffic identified	IPS-SWG
MALWARE-OTHER Generic.Meta.Phishing traffic detected	IPS-SWG

Related blogs

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

OpenClaw's Hologram: Fake Installer Ships Rust Infostealer

OpenClaw's Hologram: Fake Installer Ships Rust Infostealer

May 7, 202615 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

Attackers Target Crypto Wallets Using Codeless Webflow Phishing Pages

Attackers Target Crypto Wallets Using Codeless Webflow Phishing Pages

October 23, 20244 min read

Cloud Threats Memo: Multiple DarkGate Loader Campaigns Exploiting Legitimate Cloud Services

October 30, 20233 min read

New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials

New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials

September 14, 20236 min read

New Phishing Technique Targeting Over 20 Crypto Wallets

New Phishing Technique Targeting Over 20 Crypto Wallets

November 10, 20223 min read

RedLine Stealer Campaign Abusing Discord via PDF Links

RedLine Stealer Campaign Abusing Discord via PDF Links

October 3, 20225 min read

Attackers Continue to Abuse Google Sites and Microsoft Azure to Host Cryptocurrency Phishing

Attackers Continue to Abuse Google Sites and Microsoft Azure to Host Cryptocurrency Phishing

September 15, 20226 min read

Abusing Google Sites and Microsoft Azure for Crypto Phishing

Abusing Google Sites and Microsoft Azure for Crypto Phishing

August 9, 20224 min read

Related families

Mask Crypt Malgent PureLogs RedLine Stealer