123 Stealer subscription sale by koneko and CIS-targeting restrictions
Threat Actor Meta
Summary
Hide ▲
Show ▼
123 Stealer was marketed as a $120-per-month subscription by the actor koneko, expanding the underground malware-as-a-service market and lowering access to credential-stealing tooling. The service was first advertised on June 17, 2025 on a dark web forum, making the sale timing and distribution channel part of the actor ecosystem. Koneko also imposed a Russia/CIS targeting ban, which suggests deliberate market segmentation and operator control over how the stealer is used. The combination of subscription pricing, customer restrictions, and forum-based promotion shows a mature criminal service model rather than a one-off malware release.
Related Happenings
Venom Stealer subscription and affiliate malware-service ecosystem
Threat Actor Meta
First: 01.04.2026 16:30
Last: 01.04.2026 16:30
Sources 1
About this happening:
**Venom Stealer** is being run as a **subscription-based** malware service with **Telegram licensing** and an **affiliate program**, signaling a more organized cybercrime ecosyste...
Venom Stealer subscription and affiliate malware-service ecosystem
Threat Actor MetaAbout this happening: **Venom Stealer** is being run as a **subscription-based** malware service with **Telegram licensing** and an **affiliate program**, signaling a more organized cybercrime ecosyste...
VenomStealer ecosystem shift changes threat-actor operations
Threat Actor Meta
First: 31.03.2026 17:51
Last: 31.03.2026 17:51
Sources 1
About this happening:
**VenomStealer** is being run as a **licensed underground service** with an **affiliate program**, shifting it from a single malware kit into a repeatable operator ecosystem that...
VenomStealer ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: **VenomStealer** is being run as a **licensed underground service** with an **affiliate program**, shifting it from a single malware kit into a repeatable operator ecosystem that...
Timeline
-
20.11.2025 18:57 2 articles · 6mo ago
koneko advertises 123 Stealer subscription access
Initial Disclosurekoneko advertised 123 Stealer on a dark web forum for $120 per month, presenting the information-stealer service as subscription malware available to buyers.
Show sources
- Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows — thehackernews.com — 20.11.2025 18:57
- Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows — thehackernews.com — 20.11.2025 18:57
-
20.11.2025 18:57 1 articles · 6mo ago
koneko bans 123 Stealer use against Russia and CIS
Untyped Phasekoneko imposed a rule forbidding customers from using 123 Stealer against Russia and the Commonwealth of Independent States (CIS), and violations were said to trigger immediate account blocking.
Show sources
- Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows — thehackernews.com — 20.11.2025 18:57