← Back to Feed

From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers

January 19, 2026 · Trend Micro · Severity: MEDIUM

This blog entry provides an in-depth analysis of the multistage delivery of the Evelyn information stealer, which was used in a campaign targeting software developers.

Key Takeaways

  • Trend Micro detailed the multistage delivery of the Evelyn information stealer in a campaign targeting software developers.
  • The campaign moves from extension to infection, abusing developer tools and workflows to deliver the stealer.
  • Developers should vet browser extensions and tooling, as stealer campaigns specifically target software development environments.
☕ Buy a Coffee