Pony

Description

Pony (a.k.a. Fareit) is an information stealer that targets credentials from browsers, FTP clients, email programs, and other applications on infected systems. It arrived through spam attachments, exploit kits, and bundled downloads, and its checker component validated stolen credentials in bulk for resale. The family's efficiency at collecting large volumes of logins made it a mainstay of the criminal credential market for years.

Stats

First seen: July 2024
Last seen: October 2026

MITRE ATT&CK techniques

16 techniques across 6 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.002Spearphishing Link
- T1566.001Spearphishing Attachment

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API
T1204User Execution
- T1204.002Malicious File
- T1204.001Malicious Link

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.015Compression
- T1027.016Junk Code Insertion
T1036Masquerading
T1070Indicator Removal
- T1070.004File Deletion
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks

TA0006 Credential Access

T1110Brute Force
- T1110.001Password Guessing

TA0007 Discovery

T1082System Information Discovery
T1087Account Discovery
- T1087.001Local Account

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

Alert name variants

Alert Name	Engine
Archive.Infostealer.Pony	ATP Sandbox Adv. Heuristics
Binary.Infostealer.Pony	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Infostealer.Pony	ATP Sandbox Adv. Heuristics
Document-Word.Infostealer.Pony	ATP Sandbox Adv. Heuristics
Email-MIME.Infostealer.Pony	ATP Sandbox Adv. Heuristics
Linux.Infostealer.Pony	ATP Sandbox Adv. Heuristics
Script-AutoIt.Infostealer.Pony	ATP Sandbox Adv. Heuristics
Script-JS.Infostealer.Pony	ATP Sandbox Adv. Heuristics
Win32.Infostealer.Pony	ATP Sandbox Adv. Heuristics
Win64.Infostealer.Pony	ATP Sandbox Adv. Heuristics