Netskope Threat Labs

Phemedrone

ATP Sandbox Adv. Heuristics

Phemedrone is an information stealer that targets browser credentials, cookies, and cryptocurrency wallets on Windows systems. Cyberattackers have distributed it through malvertising and fake CAPTCHA pages that trick users into running malicious commands themselves.

First seen
August 2023
Last seen
September 2026
Alert Name
ByteCode-MSIL.Spyware.Phemedrone
ByteCode-MSIL.Trojan.Phemedrone