In early December, Trustwave SpiderLabs discovered a new malware named Ov3r_Stealer designed to steal credentials and crypto wallets. The initial attack vector was a weaponized PDF file distributed via Facebook ads. Once executed, the malware establishes persistence and exfiltrates data to a Telegram channel. The malware shares similarities with Phemedrone, an open-source malware written in C#. The investigation uncovered affiliations between the threat actors and hacking forums where malware is developed and cracked software is shared.