Rhadamanthys

Description

Rhadamanthys is a modular information stealer sold as a subscription service that targets credentials, browser data, and cryptocurrency wallets on infected systems. Its implementation includes advanced evasion features, and its operators ship regular updates that add capabilities such as clipboard hijacking and screenshot capture. Distributors reach victims through malvertising, search engine poisoning, and fake software downloads, and stolen data feeds established criminal marketplaces.

Stats

First seen: January 2023
Last seen: October 2026

Also known as

RhadamanthysStealer

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Spyware.Rhadamanthys	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.Rhadamanthys	ATP Sandbox Adv. Heuristics
Document-PDF.Trojan.Rhadamanthys	ATP Sandbox Adv. Heuristics
Script-BAT.Spyware.Rhadamanthys	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Rhadamanthys	ATP Sandbox Adv. Heuristics
Script-PowerShell.Spyware.Rhadamanthys	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.Rhadamanthys	ATP Sandbox Adv. Heuristics
Script-WScript.Spyware.Rhadamanthys	ATP Sandbox Adv. Heuristics
Win32.Downloader.Rhadamanthys	ATP Sandbox Adv. Heuristics
Win32.Exploit.Rhadamanthys	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Rhadamanthys	ATP Sandbox Adv. Heuristics
Win32.Spyware.Rhadamanthys	ATP Sandbox Adv. Heuristics
Win32.Trojan.Rhadamanthys	ATP Sandbox Adv. Heuristics
Win32.Trojan.RhadamanthysStealer	ATP Sandbox Adv. Heuristics
Win64.Spyware.Rhadamanthys	ATP Sandbox Adv. Heuristics
Win64.Trojan.Rhadamanthys	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection	IPS-SWG
MALWARE-OTHER Win.Trojan.Rhadamanthys variant payload download attempt	IPS-SWG

Related blogs

$Sandbox process tree for the Underground loader, showing an injected dllhost.exe launching chrome.exe and msedge.exe and staging stolen cookies under C:\ProgramData\Underground, before a second dllhost.exe deletes that folder.$