{
  "family": "eyestye",
  "sample_count": 84,
  "category": "infostealer",
  "description": "EyeStye (cataloged across security vendors under signatures including PWS:Win32/EyeStye, Trojan:Win32/EyeStye, and Worm:Win32/EyeStye) is a specialized password-stealing trojan and rootkit threat active since 2010. Engineered to compromise online banking accounts, payment portals, and enterprise web applications, EyeStye hooks Windows networking APIs and web browser processes to execute form-grabbing attacks, intercepting sensitive usernames, plaintext passwords, and credit card data before transport encryption occurs. To maintain stealth, EyeStye incorporates kernel-mode and user-mode rootkit modules that conceal its running processes, disk files, and registry entries from standard Windows task monitoring utilities and security software. The malware also includes secondary downloader routines that receive remote commands to update its configuration or download secondary malicious tools such as cryptocurrency clippers and remote access proxies.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PWS:Win32/EyeStye",
    "Trojan:Win32/EyeStye",
    "Worm:Win32/EyeStye",
    "Win32/EyeStye"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PWS:Win32/EyeStye?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "EyeStye is a password-stealing trojan equipped with browser form-grabbing hooks and rootkit concealment capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How does EyeStye capture user credentials?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks web browser processes to intercept user inputs and form submissions before data is encrypted and sent to websites."
      }
    },
    {
      "@type": "Question",
      "name": "What rootkit features does EyeStye utilize?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It conceals its executable processes, files, and registry persistence keys from Windows Task Manager and security tools."
      }
    },
    {
      "@type": "Question",
      "name": "How is EyeStye distributed to victim computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through spearphishing emails with malicious attachments, weaponized downloads, and secondary downloader droppers."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken if EyeStye is detected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the computer, run offline rescue antimalware to bypass rootkit hooks, and immediately reset all critical passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1056.001",
    "T1056.004",
    "T1055.001",
    "T1014",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.004",
      "name": "Credentials from Password Stores: Windows Credential Manager",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active exfiltration of the harvested credential archives.",
    "Force a global, mandatory password reset for the compromised user, prioritizing corporate VPN access, email accounts, and financial portals.",
    "Capture a full forensic memory image to extract the active Eyestye payload and identify the specific C2 infrastructure it is communicating with.",
    "Assume all locally saved passwords have been compromised; perform a clean OS rebuild to ensure the infostealer is completely eradicated."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected, as the infostealer may include keylogging capabilities.",
    "Avoid assuming the threat is contained just by removing the executable; the exfiltrated passwords must be reset globally."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft & Credential Harvesting",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2010,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Attachments",
    "Trojanized Software Installers",
    "Drive-by Downloads"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Browser Form-Grabbing",
    "Rootkit Process Concealment",
    "Keystroke Logging",
    "Secondary Payload Downloading",
    "C2 Telemetry Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Kernel Driver (SYS)",
      "DLL Hook"
    ],
    "network_signatures": [
      "Encrypted POST requests transmitting stolen form credentials to remote C2",
      "Automated configuration updates over HTTP"
    ],
    "evasion_techniques": [
      "Rootkit hooks masking process table entries",
      "API hooking in memory to evade file integrity scanners"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\EyeStye",
      "Service registration under HKLM\\SYSTEM\\CurrentControlSet\\Services"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Online banking credentials, enterprise accounts, kernel rootkit subversion"
  },
  "lineage": {
    "derived_from": [
      "Classic Win32 Password Stealers"
    ],
    "variants": [
      "EyeStye.A",
      "EyeStye.B",
      "EyeStye.Rootkit"
    ]
  },
  "iocs": {
    "file_hashes": [
      "e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2",
      "a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
    ],
    "delivery": [
      "bank_statement.exe",
      "secure_reader.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\EyeStyeHook",
      "C:\\Windows\\System32\\drivers\\eyestye.sys"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - PWS:Win32/EyeStye",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/EyeStye"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PWS.Win32.Eyestye",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pws.win32.eyestye"
    }
  ]
}