Katz Stealer is a malware-as-a-service information stealer—not a browser vulnerability or add-on. Analyses published by Broadcom and Nextron in May 2025 report that it can collect browser passwords, cookies and session tokens, along with cryptocurrency wallet data. Researchers also describe phishing and deceptive downloads as delivery routes. These findings describe specific analyses and do not mean every Katz infection has the same capabilities.
What is Katz Stealer?
Katz Stealer is described by security researchers as an information-stealing malware service. In this model, the malware is used to collect information from infected computers; it is not itself a flaw in Chrome, Firefox, or another browser. Broadcom’s May 29, 2025 bulletin and Nextron Systems’ May 23, 2025 analysis both characterize Katz as a threat that targets browser data and cryptocurrency-related information.
The technical capabilities below are reported by those vendors for their respective analyses. They should not be read as a guarantee that every version, operator, or infection collects every listed item.
What browsers and information does Katz Stealer target?
Browser data
Broadcom reports that Katz targets saved passwords, cookies, and session tokens from Chrome, Microsoft Edge, Brave, and Firefox. Nextron names the same four browsers. Browser-stored credentials and session data are also a recognized credential-theft category in MITRE ATT&CK’s general reference for Credentials from Web Browsers (T1555.003); that page provides context, not independent confirmation of Katz’s behavior.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Access to a saved password or session token can put online accounts at risk, but the technical reports do not establish that every collected item can be used successfully. The outcome depends on the data obtained and the account or service involved.
Wallets and browser extensions
The analyses describe searches for wallet-related files and information, including seed phrases and private keys. Nextron lists standalone wallet applications such as Exodus, Bitcoin Core, Litecoin, Dogecoin, Dash, Electrum, Ethereum, Coinomi, Daedalus, Monero, Wasabi, and Ravencoin. It also reports identifying 154 cryptocurrency-wallet extension IDs and discusses Brave’s built-in wallet storage separately.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
A separate 2026 Check Point Research investigation reports 332 browser-extension identifiers in captured encrypted task responses. Check Point categorized them as follows:
| Category | Identifiers in the captured task responses |
|---|---|
| Wallet extensions | 220 |
| Password managers | 77 |
| 2FA/TOTP tools | 18 |
| Notes | 11 |
| Payment-related extensions | 6 |
Check Point gives examples of wallet names in its captured list, including MetaMask, Rabby, Coinbase Wallet, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, Phantom, Solflare, TronLink, and Exodus. These are counts from that investigation’s captured tasking, not a measure of all Katz deployments or users. They are also a different observation from Nextron’s 154 extension IDs, so the figures should not be treated as a like-for-like change over time.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Listing a wallet or extension as a target does not establish that an attacker can recover funds from it. Check Point notes that what may be exposed depends on the wallet and its state.
Other reported collection and surveillance
Broadcom describes screen-capture and clipboard-monitoring capabilities. Nextron’s analysis also reports collection involving messaging applications, email, Steam, VPN configurations, FTP credentials, Wi-Fi credentials, and Ngrok tokens. These are capabilities reported in analyzed material, not evidence that each Katz operator uses every feature or that every infected computer yields all of these data.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
How does Katz Stealer infect a computer?
Nextron reports distribution through phishing emails, fake software downloads, malicious advertising, and manipulated search results. A user may be led to open a deceptive attachment or download, or to run software obtained from an untrusted source.
In the typical chain described by Nextron, a compressed gzip file contains obfuscated JavaScript. That JavaScript downloads an obfuscated Base64-encoded PowerShell script; the script obtains a loader, which injects the stealer into a legitimate process. The active malware then sends collected information to command-and-control infrastructure. This is a high-level account of the reported chain, not a set of instructions for reproducing it.
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Nextron also describes system reconnaissance, geographic restrictions, virtual-machine and sandbox evasion, process hollowing, and misuse of legitimate Windows utilities. These behaviors can complicate analysis and detection. Their presence in an analysis does not confirm that they appear in every deployment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What detection information is available?
Nextron identifies several possible sources of defensive detection evidence:
- Network traffic associated with suspicious communications.
- Unexpected file creation or suspicious process activity.
- Unusual access to browser credential stores.
- Unexpected headless-browser execution.
Nextron links YARA and Sigma rules addressing Katz-related domains and payloads, the loader, and suspicious access to browser credential files. It also names THOR Cloud Lite, THOR Lite, and enterprise THOR as scanner options. These are vendor-described detection resources and products; the cited analysis does not establish that they detect every Katz variant or guarantee cleanup. A detection alert is a reason to investigate, not proof by itself that a computer is infected.
What to do if you suspect an infection
Because Katz is reported to target both browser data and other sensitive information, treat a credible detection or exposure as a potential account-security incident. Use a separate, known-clean device for account recovery if you can.
Quick Recap
- Stop using the suspected computer for sensitive logins. Avoid entering passwords, approving wallet activity, or handling recovery phrases on it while you investigate.
- Contact your organization’s IT or security team if the device is managed. They can preserve evidence and follow the organization’s incident-response process.
- From a clean device, secure important accounts. Change passwords for affected accounts, revoke active sessions where the service offers that option, and review account activity. Prioritize email and financial accounts because they can be used to reset or access other services.
- For cryptocurrency wallets, follow the wallet provider’s incident guidance. If recovery phrases or private keys may have been exposed, do not enter them on the suspected device. A new wallet with new keys may be needed; moving assets carries risks, so use trusted wallet-provider guidance and verify destinations carefully.
- Have the computer assessed and restored using trusted support. A scanner result can inform the investigation, but no single scan should be treated as proof that a system is clean.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
