MALWARE FAMILY

Oski Stealer

Internal ID: win.oski

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Oski is a stealer written in C++ that appeared around November 2019 and is being sold for between 70$ to 100$ on Russian-speaking forums. It collects different types of data (cryptocurrency wallets, saved passwords, files matching an attacker-defined pattern etc) and it exfiltrates it in a zip file uploaded to the attacker's panel.

Threat Analysis

Oski Stealer is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://3xp0rt.com/posts/mars-stealer

→https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become

→https://cyberint.com/blog/research/mars-stealer/

→https://drive.google.com/file/d/11AusNbBqFb0eoUADOPyltSWHU7Z2XHEP/view

→https://drive.google.com/file/d/1c72YIF6JYcEvbFZCrkZO26D9hC3gnyMP/view

→https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468

→https://labs.bitdefender.com/2020/03/new-router-dns-hijacking-attacks-abuse-bitbucket-to-host-infostealer/

→https://medium.com/shallvhack/oski-stealer-a-credential-theft-malware-b9bba5164601

→https://twitter.com/albertzsigovits/status/1160874557454131200

→https://www.cyberark.com/resources/threat-research-blog/meet-oski-stealer-an-in-depth-analysis-of-the-popular-credential-stealer

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.oski

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Oski Stealer