Cracking Kynx: The Stealer Hunting for Your Wallets, Games, and AI Tools

Kynx is a new Malware-as-a-Service infostealer, built in C++ with AI assistance and promoted on a Turkish game cheating forum. It targets browser credentials, 65 crypto wallet extensions, 16 gaming platforms, and 8 AI coding tools including Claude Code and Cursor.

Infostealers are a rapidly evolving threat, enabling various adversaries, ranging from ransomware groups and hacktivists to nation-state actors, to exploit stolen credentials for unauthorized access to sensitive resources. In today’s threat landscape, identity is a primary target, with attackers seeking diverse credentials including usernames, passwords, tokens, and seed phrases. The integration of AI has further trivialized malware development, allowing for the continuous emergence of new infostealers without requiring extensive programming expertise.

Following a post by skocherhan on X, the SOCRadar Threat Research Unit (STRU) analyzed Kynx, a Malware-as-a-Service (MaaS) stealer featuring a web panel deeply integrated with the malware’s execution flow.

External Threat Landscape

An investigation into underground forums revealed a post from January 2026 on cheatglobal[.]com, a Turkish-centric marketplace for game modding and cheating. The author, identified as kakayiyenfatali (Discord: antxchris), documented the development of Kynx (prior version 2.0). The advertisement highlighted advanced capabilities, including App-Bound Encryption (ABE) bypass and sophisticated anti-VM modules.

Notably, the threat actor (a “Legendary Member” with over 4,300 posts) admitted to using Gemini to assist the malware’s development. Currently, the platform operates as a Malware-as-a-Service (MaaS) offering Free, Plus, Pro, and Ultra subscription tiers, with premium features restricted to users possessing an invite code.

Technical Analysis

STRU analyzed a Kynx binary compiled on June 3, 2026. Upon execution, Kynx opens with a fake “System update” banner, rendering an animated terminal progress bar cycling through messages like “Downloading required files” and “Please wait while we sync with the server,” mimicking a software update page. While unconfirmed, this setup indicates the actor intends to distribute Kynx via cracked software or a ClickFix lure.

Anti-Analysis & Evasion Engine

Before Kynx initiates its credential harvesting modules, it runs a function to check if it is being executed inside a malware analyst’s lab, an automated antivirus sandbox, or a virtual machine.

It does this by running a series of hardware and software checks, assigning “penalty points” for suspicious findings. If the total penalty score is 3 or higher, it aborts execution. It logs all these checks into a file in the %TEMP% directory named kynx_vmcheck.txt. Dynamic analysis suggests the anti-analysis features failed to deploy as intended.

Kynx’s Anti-VM scoring engine:

Kynx then evaluates the result of the anti-analysis checks and writes either “PASS” or “FAIL – KILLED” to kynx_early.txt. If the checks are passed, it attempts to create a directory named WinSysHealth-{6 number digits} (for staging the stolen data) and drops a file named debug.txt inside it to capture the stealer’s progress.

In addition, as part of other modules such as sysinfo, where system information are also sent to the stealer’s panel (described in the Exfiltration section), Kynx calls CreateToolhelp32Snapshot() to generate a list of every process currently running on the victim’s machine. It loops through the running tasks and performs a string comparison against an array of hardcoded endpoint security and malware analysis tools.

Table of malware analysis tools enumerated by Kynx:

Endpoint security products enumerated by Kynx:

Browser Credential Stealing

Afterwards, Kynx starts by implementing a four-method cascade (MCE -> DBS -> ChromeElevator -> raw copy) for browser credential extraction, falling back to successive methods on failure:

1. MCE (Modified Chrome Elevator)

This is the primary method of browser credential extraction. For that, it utilizes a modified version of Chrome Elevator, which is a post-exploitation tool performing in-memory bypass of Chromium’s App-Bound Encryption (ABE). It downloads the executable from hxxps[://]kynxdev[.]xyz/payloads/mce[.]exe (with https://github.com as Referrer) to disk and runs it using CreateProcessA with the arguments of “–kill -o “[TempDirectory]” all”, instructing the executable to kill all browser processes before extracting all data and saving the output to the temp directory created. In addition, it uses a key to run MCE, also identified in the configuration of Kynx’s panel (kaakkak28288nddhhBDAAD8282ksksk).

For timeout it calls WaitForSingleObject(hHandle, 90000) which gives the external payload 90 seconds to complete its execution. Once the 90 seconds pass (or the tool finishes), it scans the output directory looking for specific artifacts: Data.json and files starting with EncPack-. If it finds them, it logs “[+] MCE: Extraction successful.” and stops the chain.

2. DBS (Dump Browser Secrets)

If MCE fails, the second option is DBS, also known as DumpBrowserSecrets. This is another post-exploitation tool for harvesting browser-stored data. It downloads the executable from hxxps[://]kynxdev[.]xyz/payloads/dbs[.]exe to disk and runs it with the arguments of “/b:all /e:all /spoof”, instructing the tool to target all browsers for unlimited entries per category and enable argument and Parent Process ID (PPID) Spoofing when retrieving ABE keys.

For timeout it calls WaitForSingleObject(hHandle, 60000) which gives the external payload 60 seconds to complete its extraction, as with MCE. Once the 60 seconds pass (or the tool finishes), it again scans the output directory looking for the same specific artifacts: Data.json and files starting with EncPack- and if it finds them, it logs “[+] DBS: Extraction successful.” and stops the chain.

3. ChromeElevator (CE)

If DBS also fails, the third option is the original Chrome Elevator tool. It downloads the executable from hxxps[://]kynxdev[.]xyz/payloads/chromelevator[.]exe to disk and runs it using the same arguments as MCE (–kill -o “[TempDirectory]” all”). The timeout for this execution is 45 seconds, and looks for the output in a directory named Browsers.

4. Raw Copy

If CE also fails, Kynx stops trying to use external tools and switches to the last resort which is a raw copy. It relies on directory_iterator to walk the victim’s filesystem and looks specifically for folders “Default” and “Profile”. In Chromium-based browsers (Chrome, Edge, Brave, Opera), user data like Login Data (passwords) and Cookies are stored in these specifically named folders. Finally, it physically copies these SQLite database files to the staging directory. Rather than decrypting them on the fly, it grabs the raw, encrypted databases so the attackers can attempt to crack the encryption offline on their own machines.

Gaming Platform Targeting

Kynx targets a variety of gaming platforms with different methods. Of special note is Roblox for which it searches the GamingRobloxdecrypted_cookie.txt and then spawns a hidden PowerShell one-liner to decrypt DPAPI-protected browser master keys. For other games such as CraftRise and SonOyuncu, it again downloads external files from the C2 for decryption (crdecrypt.exe and som_helper.exe)

PowerShell one-liner for DPAPI decryption:

Gaming platforms targeted by Kynx:

Discord Token Theft

Kynx also performs Discord token theft by first removing the protections, then scanning for tokens, and then using Discord’s API to enumerate the accounts behind those tokens.

To remove protections, Kynx targets all Discord variants (Stable, Canary, and PTB) by deliberately overwriting the core index.js file with its default, uninfected code (core.asar), effectively wiping out any modifications. It then actively navigates the filesystem to locate and delete specific security tools and client modifications, systematically removing ProtectionPayload.dll and secure.dat to disable DiscordTokenProtector, alongside deleting BetterDiscord archives (betterdiscord.asar).

Rather than searching the application directories blindly, Kynx targets the base installation paths (%APPDATA%Discord, %APPDATA%discordcanary, and %APPDATA%discordptb) specifically to locate two critical components. First, it copies the Local State file from the root of each profile to extract the master key. Next, it dives into the Local Storageleveldb subfolders to pull the raw binary .ldb and .log databases where Discord natively caches its session data. Using the DPAPI and the stolen master key, Kynx decrypts the database contents in memory. Next, it scans the decrypted data using specific regex patterns to identify and exfiltrate standard Discord user tokens ([A-Za-z0-9_-]{24,28}.[A-Za-z0-9_-]{6}.[A-Za-z0-9_-]{27,38}) and MFA tokens (^mfa.[A-Za-z0-9_-]{84}$). Finally, using the stolen tokens, Kynx queries the Discord API for information:

• /api/v9/users/@me: User profile, MFA status, phone, email, premium type, flags
• /api/v9/users/@me/billing/payment-sources: Payment methods on file
• /api/v9/users/@me/guilds?with_counts=true: Guild / server membership
• /api/v9/users/@me/relationships: Friends list

Cryptocurrency Wallet Theft

Kynx Stealer also targets a wide range of crypto assets across both desktop clients and browser extensions.

Crypto desktop applications targeted by Kynx:

Browser extension wallets targeted by Kynx Stealer:

In addition, the stealer scans the Desktop, Documents, and Downloads folders for seed phrase documents through the regular expression: “(seed|mnemonic|private.?key|wallet.?recovery|12.?words|24.?words|phrase|metamask|ledger)”. A seed phrase (also known as a recovery or mnemonic phrase) is a sequence of 12 to 24 random words generated by the crypto wallet. It acts as a master key to mathematically regenerate all private keys and crypto addresses, allowing anyone holding it to back up or restore full access to existing funds.

Web Service Session Cookie Extraction

After collecting the data, Kynx also categorizes active session tokens from web services. Each session file is saved with usage instructions so the operator can immediately replay the session on each service.

Tokens extracted for web services by Kynx:

VPN Configuration Theft

VPN credentials and configuration files from a variety of tools are also a target.

VPN credentials targeted by Kynx:

Email & FTP Client Data Theft

Kynx also collects data from email and FTP clients:

Email and FTP clients targeted by Kynx

Developer & AI Tool Targeting

Finally, Kynx includes a dedicated “DevGrabber” module that specifically collects data from AI coding assistants:

AI coding assistants targeted by Kynx

Exfiltration

For exfiltration, Kynx utilizes the ChunkSender module which uses HTTP POST requests through data chunks sequentially towards the web panel (hxxps[://]kynxdev[.]xyz/api/v1/ingest.php?cat={chunk}).

Chunks supported by Kynx:

All requests include the header X-Kynx-Token, a single-use token with 5 minute validity (to avoid replay attacks) for authenticating the victim to the web panel and an X-Owner-ID (created upon execution – === KYNX STARTED (OWNER_UID=%d) ===) to distinguish victims between operators. Any request lacking valid, non-expired session Kynx tokens results in an immediate permanent IP ban:

After running all the stealing modules, Kynx Stealer sends the first chunk which is a system profile with metadata of stolen information (hxxps[://]kynxdev[.]xyz/api/v1/ingest.php?cat=meta). In this request the web panel responds back with a new UUID to uniquely identify and store victim data. For the following chunks this UUID is used in the HTTP POST requests.

Conclusion

Kynx is yet another addition to the evolving infostealer landscape, demonstrating how easily adversaries continue to refine their methods with AI for harvesting credentials. As attackers increasingly target identity as a primary vector for unauthorized access, organizations must prioritize proactive security measures against identity-centric threats. Furthermore, it is critical for security teams to actively explore their attack surface within infostealer logs to identify compromised accounts and mitigate risks before they escalate into full-scale breaches.

MITRE ATT&CK TTPs for Kynx Stealer

Indicators of Compromise of Kynx Stealer

YARA Rule for Kynx Stealer

rule Kynx_Stealer {
    meta:
        description = "Detects Kynx Stealer by static strings"
        author = "SOCRadar Threat Research Unit (STRU)"
        date = "2026-07-17"
        hash = "4f7e6f33e7e80b17f5c7f59ba45f3e32431b639b7d91c2bda1b26664788c8b8b"

    strings:
        // Network
        $net1   = "X-Kynx-Token:" ascii
        $net2   = "?cat=files" ascii

        // Files
        $file1  = "kynx_vmcheck.txt" ascii
        $file2  = "kynx_files.zip" ascii
        $file3  = "kynx_early.txt" ascii
        $file4  = "som_helper.exe" ascii
        $file5  = "crdecrypt.exe" ascii
        $file6  = "debug.txt" ascii

        // Behavior
        $beh1   = "--- KYNX DEBUG LOG ---" ascii
        $beh2   = "=== KYNX STARTED (OWNER_UID=" ascii
        $beh3   = "KynxCR_" ascii
        $beh4   = "KynxSO_" ascii
        $beh5   = "DevGrabber" ascii
        $beh6   = "Priority: MCE -> DBS -> ChromeElevator -> raw copy" ascii
        $beh7   = "[=] FINAL SCORE: %d (Target: " ascii
        $beh8   = "[!] Being Debugged (PEB): %s (+" ascii
        $beh9   = "_IAS_ACCOUNTS_DO_NOT_SEND_TO_ANYONE" ascii
        $beh10  = "MCE/DBS/CE all failed" ascii
        $beh11  = "WinSysHealth" ascii

    condition:
        uint16(0) == 0x5A4D and
        (
            1 of ($net*) and 2 of ($file*) and 3 of ($beh*)
        )
}