Facebook warns of infostealer StealC v2 in Greece too

Since late August 2025, Kaspersky’s Global Research and Analysis Team (GReAT) has identified a new malicious campaign that leverages the infostealer StealC v2, a malware designed to steal passwords and other account information. The campaign appears to be spreading via Facebook messages, with more than 400 incidents recorded to date in multiple countries – including Europe, including Greece.

Facebook users are receiving messages containing links disguised as account blocking notifications as part of this malicious campaign.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

An example of a phishing message disguised as an account lockout notice

Clicking the link opens a fake support page claiming that the user’s account has been blocked due to suspicious activity. To “restore access,” users are asked to use the “Appeal” button, which initiates the download of malicious code that installs StealC v2 — a dangerous malware delivered under the Malware-as-a-Service model — on the victim’s device. The malware itself steals passwords, cookies, screenshots, and cryptocurrency wallet data.

A phishing message with a button that downloads the information-stealing program when you click it

“Cybercriminals often exploit the fear of losing access and create a sense of urgency, pressuring users to act without a second thought. This increases the risk of infection with malware like StealC v2. Being vigilant and verifying the authenticity of every message before clicking are critical security practices ,” said Marc Rivero, lead security researcher at Kaspersky GReAT.

StealC v2, first observed in 2025, is an upgraded version of the original StealC, which had appeared in 2023 on dark web platforms and quickly became popular among cybercriminals thanks to its ease of use and wide availability.

To protect themselves from phishing attacks, Kaspersky recommends that users of corporate and personal accounts:

• Sometimes emails and websites look like the real thing. This depends on how well the criminals have prepared. However, the hyperlinks are usually incorrect, contain spelling errors, or may redirect you to a different website.
• Be wary of messages that create a sense of urgency or contain threats. Cybercriminals are trying to pressure you into taking hasty actions, such as changing your password or providing personal information.
• Verify every unsolicited message, call, or link, even if it seems legitimate. Never share two-factor authentication (2FA) codes.
• Use some reliable security software

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.