MALWARE FAMILY

KPOT Stealer

Internal ID: win.kpot_stealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

KPOT is an information-stealing Trojan horse that can steal information from infected computers. It is distributed through phishing emails and malicious websites. Once executed on a computer, KPOT can steal passwords, credit card numbers, and other personal information.

Threat Analysis

KPOT Stealer is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blag.nullteilerfrei.de/2020/04/26/use-ghidra-to-decrypt-strings-of-kpotstealer-malware/

→https://blog.ensilo.com/game-of-trojans-dissecting-khalesi-infostealer-malware

→https://github.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/blob/main/kpot2/KPOT.md

→https://isc.sans.edu/diary/25934

→https://isc.sans.edu/diary/26010

→https://medium.com/s2wlab/deep-analysis-of-kpot-stealer-fb1d2be9c5dd

→https://news.drweb.com/show/?i=13242&lng=en

→https://umbrella.cisco.com/blog/navigating-cybersecurity-during-a-pandemic-latest-malware-and-threat-actors

→https://www.flashpoint-intel.com/blog/malware-campaign-targets-jaxx-cryptocurrency-wallet-users/

→https://www.proofpoint.com/us/threat-insight/post/new-kpot-v20-stealer-brings-zero-persistence-and-memory-features-silently-steal

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.kpot_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search KPOT Stealer