KuinaExtractor Rust Infostealer Evolves With Telegram Exfiltration, UAC Bypass, and Sandbox Checks

KuinaExtractor is a newly documented Rust-based infostealer that has been under active development since at least December 2025. The malware targets browser data, crypto wallets, and credentials from services such as Roblox, Steam, Discord, and Telegram.

According to ThreatRay, the malware family moved through four main stages in six months. Early builds focused on theft and delivery, while newer builds added stronger concealment, Telegram-based exfiltration, UAC bypass options, and sandbox detection.

The latest activity shows a shift from the original KuinaExtractor name to “k0to.” Researchers said this rebrand did not mark a major change in purpose. Instead, it showed the operator’s growing focus on hiding existing capabilities and making the stealer harder to analyze.

KuinaExtractor Shows Fast Malware Development

ThreatRay tracked KuinaExtractor by comparing code similarities at the function level. That method helped researchers group dozens of samples into the same malware family, even as names, infrastructure, and internal details changed over time.

The same markers appeared across multiple builds. These included recurring mutex names, build-host paths left inside binaries, Telegram contact handles, and shared code patterns. The original “Kuina” alias later gave way to “k0to,” but the underlying development trail remained visible.

The report also points to Vietnamese-language strings in debug output, console messages, and collected system information. A command-and-control panel hosted in Vietnam and support for the Vietnamese CocCoc browser provide additional context, but the report treats these as supporting signals rather than firm attribution.

Stage	Period	Main Change	Why It Matters
First build	December 2025	Browser theft, crypto wallet theft, Discord webhook exfiltration	Showed the malware was capable from its earliest known version
Rewrite	January 2026	Telegram bot exfiltration, reconnaissance, multiple UAC bypass methods	Made the malware more flexible and operationally mature
Production hardening	March 2026	More browser targets, SilentCleanup UAC bypass, VM and sandbox checks	Improved persistence against defensive and analysis environments
Rebrand	June 2026	“k0to” name, encrypted strings, self-contained TLS handling	Shifted the focus toward stealth and concealment

What KuinaExtractor Steals From Infected Systems

KuinaExtractor focuses on information that can quickly be monetized or reused in follow-on attacks. Its targets include browser cookies, saved credentials, crypto wallets, Discord tokens, Steam sessions, Roblox data, and Telegram session files.

The earliest known builds already included a Chrome App-Bound Encryption bypass. That capability allowed the malware to target browser encryption protections and recover sensitive data stored by newer Chrome versions.

By March 2026, browser coverage had expanded to around 40 applications, including CocCoc. That wider coverage increases the risk for users who rely on Chromium-based browsers and assume their saved sessions remain protected after infection.

Telegram Exfiltration Replaced Discord Webhooks

One of the major changes came in January 2026, when KuinaExtractor moved from Discord webhook exfiltration to a Telegram bot. That change gave the operator a more controlled channel for receiving stolen files.

The June “k0to” build appears to use Telegram in a more restricted way. ThreatRay said the channel became push-only, meaning the malware uploads files but does not poll for commands. This reduces interactive command-and-control behavior that defenders may detect more easily.

The public ThreatRay IOC and YARA repository lists multiple samples and Telegram-related command-and-control entries. The same repository also provides detection material that security teams can use for hunting and triage.

UAC Bypass and Reconnaissance Raised the Risk

KuinaExtractor’s January rewrite added a broader reconnaissance phase before the main theft routine. The malware collected hardware details through WMIC, enumerated WiFi SSIDs, dumped Windows Credential Manager data, and checked the victim’s public IP location.

The same version replaced a single UAC bypass with a table of seven possible methods. That gave the malware more fallback options if one privilege escalation route failed or had been blocked.

Later builds refined the approach. By March 2026, KuinaExtractor had moved to the SilentCleanup UAC bypass technique and added broader VM and sandbox detection, making analysis and automated detonation harder.

• Collects browser cookies, credentials, and session data
• Targets crypto wallets and popular gaming or communication platforms
• Uses Telegram for stolen-data delivery in newer builds
• Adds UAC bypass options to increase privileges
• Checks for sandbox, VM, and analyst environments

The “k0to” Build Focuses on Stealth

The June 2026 build shows a clear move toward concealment. It removes the Kuina name from the binary and wraps strings in 28-byte XOR encryption, including the Telegram command-and-control URL.

The build also ships its own certificate roots through a self-contained HTTP stack. That means it does not rely on the Windows trusted certificate store in the same way many applications do.

Another anti-analysis feature scans PowerShell window titles for tools often used by malware analysts. This type of check can help the malware avoid running normally in research environments.

Side Projects Point to the Same Operator

ThreatRay also documented two parallel projects tied to the same developer. The first, KuinaCookieExtractor, was a smaller Rust-based tool that targeted browser cookies, Roblox and Steam sessions, Minecraft, FileZilla, Telegram tdata, and Discord tokens.

The second was “Zenith,” a short-lived command-and-control experiment. A debug build wrote logs to a file on the victim’s desktop and used a mutex disguised as a network adapter name.

These experiments appear to have been abandoned quickly. However, shared code markers and operator handles connect them to the same broader KuinaExtractor activity described in the KuinaExtractor report.

Indicators and Detection Guidance

Security teams should treat KuinaExtractor as an active infostealer family rather than a one-off malware sample. The continued appearance of new builds suggests ongoing development and operational testing.

The published IOC repository includes sample hashes, defanged C2 references, and detection material. Defenders can use these indicators to hunt for suspicious files, Telegram bot traffic, and malware strings linked to the Kuina and k0to aliases.

ThreatRay’s YARA rule identifies KuinaExtractor by combining file properties with strings such as mutex values, Telegram handles, user-agent strings, and source-file references. This gives defenders a practical starting point for endpoint scans and malware triage.

Indicator Type	Example	Use Case
Alias	kuina1999, k0to	Track related builds and operator-linked samples
Mutex	Rust_Extractor_Mutex_V2	Identify malware execution artifacts on Windows systems
Defanged IP	103.229.53[.]18	Investigate possible Zenith-linked infrastructure
Debug file path	%USERPROFILE%\Desktop\zenith_debug.txt	Check for traces from the Zenith experiment build

How Users and Organizations Can Reduce Risk

The main risk from KuinaExtractor is credential and session theft. Once attackers steal browser cookies or tokens, they may access accounts without needing the victim’s password again.

Users should avoid running unsigned executables, cracked software, fake game tools, and unknown scripts. Organizations should monitor unusual Telegram API traffic, browser process termination, credential access events, and attempts to disable Microsoft Defender.

Teams should also rotate exposed credentials, revoke active sessions, and require multi-factor authentication for sensitive services. MFA does not stop every token-theft attack, but it still reduces the impact of stolen passwords and blocks many follow-on login attempts.

• Block suspicious Telegram API connections where business use is not required
• Monitor attempts to access browser profile folders and Credential Manager
• Audit UAC bypass attempts and unusual scheduled task activity
• Use endpoint detection rules for known KuinaExtractor strings and hashes
• Force sign-out and token revocation after suspected compromise

FAQ