Find notable cyber news and cases, enriched with sources, timelines, and signals.

123 Stealer subscription sale by koneko and CIS-targeting restrictions

Threat Actor Meta
First reported
Last updated
Happening score
H score 28
1 unique sources, 1 articles

Summary

Hide ▲

123 Stealer was marketed as a $120-per-month subscription by the actor koneko, expanding the underground malware-as-a-service market and lowering access to credential-stealing tooling. The service was first advertised on June 17, 2025 on a dark web forum, making the sale timing and distribution channel part of the actor ecosystem. Koneko also imposed a Russia/CIS targeting ban, which suggests deliberate market segmentation and operator control over how the stealer is used. The combination of subscription pricing, customer restrictions, and forum-based promotion shows a mature criminal service model rather than a one-off malware release.

Related Happenings

Venom Stealer subscription and affiliate malware-service ecosystem

Threat Actor Meta
First: 01.04.2026 16:30 Last: 01.04.2026 16:30 Sources 1

About this happening: **Venom Stealer** is being run as a **subscription-based** malware service with **Telegram licensing** and an **affiliate program**, signaling a more organized cybercrime ecosyste...

VenomStealer ecosystem shift changes threat-actor operations

Threat Actor Meta
First: 31.03.2026 17:51 Last: 31.03.2026 17:51 Sources 1

About this happening: **VenomStealer** is being run as a **licensed underground service** with an **affiliate program**, shifting it from a single malware kit into a repeatable operator ecosystem that...

Timeline

  1. 20.11.2025 18:57 2 articles · 6mo ago

    koneko advertises 123 Stealer subscription access

    Initial Disclosure

    koneko advertised 123 Stealer on a dark web forum for $120 per month, presenting the information-stealer service as subscription malware available to buyers.

    Show sources
  2. 20.11.2025 18:57 1 articles · 6mo ago

    koneko bans 123 Stealer use against Russia and CIS

    Untyped Phase

    koneko imposed a rule forbidding customers from using 123 Stealer against Russia and the Commonwealth of Independent States (CIS), and violations were said to trigger immediate account blocking.

    Show sources