A new version of the Gremlin stealer has evolved from a basic credential harvester into a modular toolkit, according to researchers at Palo Alto Networks’ Unit 42. The infostealer first emerged in April 2025, now just 12 months later the threat has rapidly evolved with new obfuscation techniques and new anti-analysis safeguards into recent builds. Gremlin stealer siphons sensitive information from compromised systems and exfiltrates it to attacker‑controlled servers for potential publication or sale. It targets web browsers, system clipboard and local storage. The new variant has an increased focus on stealth and is specifically designed to evade static analysis tools, according to the research. This includes the malware authors shifting the malicious payload into the .NET Resource…