Kynx Stealer: AI-Assisted MaaS Targeting Identity and Developers

Kynx is a newly identified Malware-as-a-Service (MaaS) infostealer first documented in early 2026 on Turkish game cheating forums by the actor 'kakayiyenfatali'. The malware is notable for being developed with assistance from the Gemini AI model and features a tiered subscription model ranging from Free to Ultra. It employs a sophisticated anti-analysis scoring engine and targets a diverse set of data, including credentials from web browsers, 65 crypto wallet extensions, 16 gaming platforms, and various developer-centric AI tools.

Technically, Kynx utilizes a four-stage cascade for browser credential extraction, including bypasses for Chromium’s App-Bound Encryption (ABE) via modified versions of the Chrome Elevator and DumpBrowserSecrets tools. It also features a dedicated 'DevGrabber' module specifically designed to exfiltrate session data and state files from AI coding assistants like GitHub Copilot, Cursor, and Windsurf.

The emergence of Kynx underscores the shifting threat landscape where identity and developer environments are primary targets. Its ability to bypass modern browser security and its focus on AI-assisted development tools make it a high-priority threat for organizations utilizing modern DevOps and AI workflows.