By 
A new Windows-based information stealer called ThirdEye has been discovered in the wild that has the capabilities to collect sensitive data from infected hosts.
The discovery was made by Fortinet FortiGuard Labs and the malware was found in an executable that was disguised as a PDF file with a Russian name "CMK Правила оформления больничных листов.pdf.exe," which translates to "CMK Rules for issuing sick leaves.pdf.exe."
The arrival vector for the malware is presently unknown, although the nature of the lure points to it being used in a phishing campaign.
The very first ThirdEye sample was uploaded to VirusTotal on April 4, 2023, with relatively fewer features.
The evolving info stealer is equipped to gather system metadata, including BIOS release date and vendor, total/free disk space on the C drive, currently running processes, register usernames, and volume information. The details are then transmitted to a command-and-control (C2) server.
A notable trait of the malware is that it uses the string "3rd_eye" to beacon its presence to the C2 server.
There is no evidence to prove that ThirdEye has been utilized in the wild. As majority of the stealer artifacts were uploaded to VirusTotal from Russia, it's likely that the malicious activity is aimed at Russian-speaking organizations.
The malware is not considered sophisticated, but it is designed to steal various information from compromised machines that can be used in future attacks.
