{
  "family": "fearless_lite",
  "sample_count": 1500,
  "category": "spyware",
  "description": "Fearless Lite (tracked across antivirus engines as Trojan-Spy.Win32.FearlessLite and Spyware.FearlessLite) is a streamlined, low-footprint variant of the Fearless Key Spy malware family. Stripped of the comprehensive administrative graphical user interface and complex configuration menus of its parent codebase, Fearless Lite was tailored for silent, high-speed automated deployment via email attachments and bundled droppers. Upon execution, the malware establishes persistent registry Run keys, hooks keystroke input using native Windows API calls, captures clipboard transactions, and transmits collected surveillance logs directly to remote drop servers using encrypted HTTP POST or SMTP protocols.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Spy.Win32.FearlessLite",
    "Spyware.FearlessLite",
    "Win32/FearlessLite.Spyware",
    "Trojan.Spy.FearlessLite"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Fearless Lite?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fearless Lite is a compact, streamlined variant of the Fearless spyware family optimized for silent background keystroke logging."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fearless Lite differ from full Fearless Key Spy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fearless Lite lacks the bulky configuration GUI, featuring a smaller binary footprint designed for stealthy automated dropper execution."
      }
    },
    {
      "@type": "Question",
      "name": "What information does Fearless Lite intercept?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It intercepts user keyboard input, clipboard contents, and active window titles to harvest user account credentials."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been used to distribute Fearless Lite?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns distributing Fearless Lite have exploited document and shortcut vulnerabilities including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can Fearless Lite be detected and remediated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy behavioral antimalware scanning, audit user startup folders and registry Run keys, and reset all potentially exposed passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1115",
    "T1547.001",
    "T1071.001",
    "T1027"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Sever endpoint network connections immediately to stop exfiltration of recorded keystrokes.",
    "Kill malicious Fearless Lite processes and remove associated startup registry keys.",
    "Inspect %APPDATA% and %TEMP% folders for stored surveillance logs and remove them securely.",
    "Enforce immediate credential resets across all accounts accessed on the compromised endpoint."
  ],
  "what_to_avoid": [
    "Do not continue typing sensitive credentials on endpoints with suspected keylogger presence.",
    "Avoid opening unverified email attachments purporting to be invoices or shipping notices."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Spy.Win32.FearlessLite",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Spy.Win32.FearlessLite/"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/FearlessLite",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/FearlessLite"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "fearless_key_spy"
    ],
    "variants": [
      "FearlessLite.Build2"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b",
      "3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d"
    ],
    "delivery": [
      "Malicious email attachments disguised as compressed utility patches",
      "Secondary dropper execution via compromised freeware distribution portals"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FearlessLiteAgent",
      "Startup folder shortcut in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}