{
  "family": "montague",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nMontague is a dedicated Information Stealer (Info-stealer) Trojan. Its primary objective is to silently infiltrate a Windows workstation, rapidly extract sensitive data (including saved browser passwords, cryptocurrency wallets, and session cookies), and exfiltrate this intelligence to a remote Command and Control (C2) server before the victim realizes the machine has been compromised.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nMontague is commonly distributed via highly targeted phishing campaigns, malicious links embedded in Discord or Telegram channels, or disguised as cracked software and game cheats on file-sharing networks.\n\nUpon execution, Montague is designed for speed and rapid data acquisition:\n<ul>\n<li><strong>Browser Hooking and Extraction:</strong> The malware immediately targets the local storage databases of popular web browsers (Chrome, Edge, Firefox, Brave). It extracts saved plaintext passwords, auto-fill data (including credit card numbers), and active session cookies. Stolen session cookies allow attackers to bypass Two-Factor Authentication (2FA) for hijacked accounts.</li>\n<li><strong>Cryptocurrency Targeting:</strong> Montague actively searches the local filesystem (specifically the `%AppData%` directory) for wallet files associated with popular cryptocurrency clients (e.g., Bitcoin Core, Electrum) and browser-based wallet extensions (like MetaMask).</li>\n<li><strong>Rapid Exfiltration:</strong> Because Info-stealers do not necessarily need to maintain long-term persistence, Montague quickly bundles the stolen data into a compressed archive and transmits it to the attacker, often utilizing encrypted channels (HTTPS) or abusing legitimate APIs (like Telegram bots) to evade network detection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Montague infection is a critical data breach. The immediate theft of session cookies and passwords can lead directly to corporate network compromise, massive financial fraud, and severe identity theft. Attackers frequently sell these \"logs\" on dark web marketplaces to Initial Access Brokers (IABs).\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the machine to halt any ongoing data exfiltration.</li>\n<li><strong>Universal Credential Reset:</strong> Assume all passwords saved in the user's browser, as well as all active web sessions, are fully compromised. The user must force a logout of all active sessions and change all passwords from a known-secure device.</li>\n<li><strong>Endpoint Eradication:</strong> Utilize enterprise EDR or anti-malware tools to locate and terminate the Montague process. Pay close attention to scheduled tasks or registry run keys, as some variants do attempt persistence to steal newly entered credentials.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.PWS.Montague",
    "Infostealer.Montague",
    "Win32/Montague"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1003",
    "T1552.001",
    "T1555.003",
    "T1048"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:31:23Z",
  "type": "Trojan / Info-Stealer",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}