⚠️ Overview

Mocton is a Python-based information stealer first documented by Zscaler ThreatLabz in December 2023, attributed to a financially motivated threat actor nicknamed "n0va" who distributes it through GitHub repositories masquerading as game cheats and cracked software. It belongs to the Stealer and Infostealer subcategory, focused on exfiltrating browser credentials, cryptocurrency wallets, and session tokens via a Telegram bot C2 channel.

🔧 Technical Capabilities

Mocton employs multiple exfiltration methods: it targets Chromium-based browsers (Chrome, Edge, Brave) and Firefox to harvest saved passwords, cookies, and autofill data; it also extracts contents from cryptocurrency wallet extensions (MetaMask, Trust Wallet) and reads Discord, Steam, and Telegram session files. The malware achieves persistence by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun using a randomly named copy of itself. Evasion techniques include checking for sandbox environments (e.g., VMWare, VirtualBox) and debugging tools via API calls, and the Python script is obfuscated using base64 and XOR encryption to avoid static detection. C2 communication occurs over HTTPS to a hardcoded Telegram bot token, sending stolen data as compressed ZIP files attached to Telegram messages. Propagation is limited to manual distribution by the attacker—no self-replication or worm capabilities are present.

📜 History & Notable Incidents

First spotted on Christmas Day 2023, Mocton was initially distributed through fake "Valorant cheats" repositories on GitHub; a subsequent campaign in February 2024 used bogus "Spotify Premium" cracked installers. No affiliated CVEs have been assigned, as it does not exploit software vulnerabilities—it relies on social engineering. Law enforcement has not publicly investigated the threat actor n0va, though GitHub has removed the known repositories.

🔍 Detection Indicators

Known file hashes include SHA-256 c4e3103d6f2a8... (truncated) from sample analysis by Zscaler; behaviorally, Mocton writes a backup of stolen data to %APPDATA% 4k3 and creates a mutex named MoctonMutex to prevent multiple instances. Network IOCs include outbound HTTPS traffic to api.telegram.org with a unique bot token parameter in the URL query string.

☠️ Risk & Impact

Mocton primarily targets individual consumers and gamers, resulting in theft of cryptocurrency funds, unauthorized account access, and privacy breaches. Financial losses are limited to the value of stolen crypto wallets (typically small amounts) and potential account takeover on gaming platforms. No large-scale enterprise breaches have been reported, and affected sectors are predominantly entertainment and personal finance.

🛡️ Mitigation

Organizations should block execution of Python scripts downloaded from untrusted sources, enforce application allowlisting, and monitor endpoints for the registry persistence key and file writes to %APPDATA% 4k3. Zscaler provides YARA rules (e.g., rule "Mocton_Stealer") in their threat intelligence report, and security teams can deploy Telegram API traffic anomaly detection to flag outbound connections to api.telegram.org with suspicious bot tokens.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.