{
  "family": "lynx",
  "sample_count": 19,
  "category": "infostealer",
  "description": "Lynx (classified across antimalware engines under designations including Trojan:Win32/Lynx, Spyware:Win32/Lynx, and Trojan.Lynx) is a modular Windows infostealer and credential harvesting trojan active since 2017. Distributed primarily through spear-phishing campaigns with weaponized document attachments, deceptive cracking tools, and drive-by download vectors, Lynx specializes in extracting sensitive user authentication data from infected endpoints. Upon execution, Lynx conducts comprehensive system profiling, checking for virtualized analysis sandboxes and debuggers. It inspects local AppData paths of major Chromium- and Gecko-based browsers (including Google Chrome, Mozilla Firefox, Microsoft Edge, and Brave) to decrypt stored login passwords, cookies, credit card numbers, and autofill entries using the Windows CryptUnprotectData DPAPI function. In addition to web browsers, Lynx targets cryptocurrency wallet directories (such as Electrum, Exodus, and MetaMask extension storage), VPN configurations, and FTP client credentials (FileZilla). Collected credentials and system telemetry are bundled into a password-protected zip file and exfiltrated over HTTP POST or encrypted HTTPS to remote command-and-control servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Lynx",
    "Spyware:Win32/Lynx",
    "Trojan.Lynx",
    "Win32/Lynx",
    "Infostealer.Lynx"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Lynx?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lynx is a modular Windows information-stealing trojan designed to harvest web browser credentials, crypto wallets, and VPN tokens."
      }
    },
    {
      "@type": "Question",
      "name": "How does Lynx extract passwords stored in web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It parses SQLite databases within Chrome and Firefox AppData directories and decrypts Master Keys using Windows DPAPI (CryptUnprotectData)."
      }
    },
    {
      "@type": "Question",
      "name": "What other sensitive information does Lynx steal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets cryptocurrency wallet data (Electrum, MetaMask), FileZilla FTP credentials, OpenVPN profiles, and system hardware specifications."
      }
    },
    {
      "@type": "Question",
      "name": "How is Lynx delivered to victim endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via phishing emails with malicious document loaders, Trojanized freeware archives, and software crack utilities."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended remediation actions for a Lynx infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the compromised computer, immediately revoke and reset all browser and corporate credentials from a secure device, and invalidate active session tokens."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1555.003",
    "T1552.001",
    "T1082",
    "T1057",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spear-phishing Emails with Macro Documents",
    "Malicious Software Cracks and Keygens",
    "Drive-by Download Aggregators"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Web Browser Password & Cookie Decryption (DPAPI)",
    "Cryptocurrency Wallet Key Harvesting (Electrum, MetaMask)",
    "System Information & Active Process Profiling",
    "Anti-Sandbox & Virtual Environment Detection",
    "Encrypted Exfiltration via HTTP/HTTPS POST"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      ".NET Framework Executable"
    ],
    "network_signatures": [
      "HTTP POST requests containing multipart form-data with compressed .zip archives",
      "Outbound HTTP traffic to dynamic DNS C2 domains with custom User-Agent strings"
    ],
    "evasion_techniques": [
      "API hashing to conceal dynamic loading of sensitive security libraries",
      "Execution delay timers to evade automated behavioral sandboxes"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b",
      "6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\LynxAgent"
    ],
    "file_paths": [
      "%AppData%\\Lynx\\lynx.exe",
      "%LocalAppData%\\Temp\\report.zip"
    ]
  },
  "defensive_measures": [
    "Implement endpoint application whitelisting and block execution from Temp and AppData directories",
    "Deploy multi-factor authentication (FIDO2/WebAuthn) to mitigate the impact of stolen session cookies",
    "Monitor network perimeters for unusual outbound HTTP POST traffic transmitting compressed archive payloads"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Lynx",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Lynx"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Infostealer.Win32.Lynx",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan:Win32/Lynx.A",
      "Spyware:Win32/Lynx.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "credential_access",
    "discovery",
    "exfiltration"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Gain & Credential Theft",
  "sample_hashes": []
}