LOSTKEYS Malware: A Stealthy Espionage Tool Targeting the West

A new piece of malware known as LOSTKEYS has emerged as a tool of choice in a string of covert cyber operations with political undertones. First detected in late 2023 and seen in active use through early 2025, LOSTKEYS is part of a strategic shift by the Russia-linked hacking group COLDRIVER, which is known for its cyber-espionage campaigns aimed at high-profile Western individuals and institutions.

Unlike traditional malware designed for mass disruption or financial theft, LOSTKEYS is tailored for highly selective, information-driven attacks. Its primary purpose is to quietly infiltrate systems, exfiltrate sensitive files, and send back key system details—all while avoiding detection.

What Is LOSTKEYS?

LOSTKEYS is a custom-built malware program capable of extracting specific file types from designated folders on a victim's computer. In addition to collecting files, it also transmits system information and running processes back to the attackers. What sets LOSTKEYS apart is its precision: it targets only systems deemed valuable, making it a tool clearly designed for espionage rather than broad-scale compromise.

The malware's name might suggest randomness, but its deployment is anything but. It has been observed in attacks aimed at government advisors, military personnel, journalists, think tanks, NGOs, and individuals with ties to Ukraine. The specific and limited scope of these targets points to their use in intelligence gathering rather than criminal profit.

How Does It Work?

The infection process begins with an advanced form of social engineering known as ClickFix. Victims are lured to a decoy website with a counterfeit CAPTCHA challenge. Believing they are verifying their identity, users are prompted to copy a PowerShell command and run it through the Windows Run dialog box. This command initiates the malware download chain.

What follows is a multistage process designed to elude detection. The first payload performs environment checks, likely to detect if it's running in a virtual machine—common in malware analysis labs. If the environment checks pass, the command retrieves a Base64-encoded script that eventually executes the LOSTKEYS malware. Once running, it quietly scans the host system, looking for predefined file types and directories, and sends the data to a remote server.

Who Is Behind It?

LOSTKEYS has been attributed to the threat group COLDRIVER, which is also tracked under names like Callisto, Star Blizzard, and UNC4057. Traditionally, this group has relied on credential phishing to access email accounts and steal sensitive communications. However, LOSTKEYS and its predecessor, SPICA, signal a new direction: direct device compromise and data extraction.

Security experts note that COLDRIVER typically operates with geopolitical motives. Its targets and tactics align closely with state-backed espionage efforts, and its past campaigns have demonstrated an interest in Western foreign policy, defense, and media sectors.

Implications of LOSTKEYS

The appearance of LOSTKEYS reflects a larger trend in cyber operations: the blending of deceptive social engineering with custom-built malware for targeted surveillance. These tactics are subtle, effective, and difficult to trace, often leaving victims unaware they've been compromised.

The implications are significant. For government agencies and organizations working on sensitive issues, especially those connected to Eastern Europe, the risk of silent data leaks has never been higher. Because LOSTKEYS is not designed to destroy or disrupt but to quietly harvest data, its presence may go undetected for long periods.

Moreover, the increasing use of tactics like ClickFix shows how attackers are adapting. Rather than trying to breach hardened defenses, they exploit human behavior—persuading users to run malicious commands themselves. This approach can bypass many traditional security controls and antivirus protections.

A Broader Trend

LOSTKEYS is not operating in isolation. Other threat actors have repurposed the ClickFix method to deliver different malware strains, including banking trojans and Mac-specific data stealers. Techniques such as EtherHiding, which hides malicious code within blockchain transactions, are being layered into these campaigns, making detection even more challenging.

One researcher recently uncovered a massive campaign called MacReaper, in which over 2,800 legitimate websites were compromised to deliver fake CAPTCHA pages. These deceptive entry points serve a variety of malware families, including Atomic Stealer, targeting macOS systems.

Staying Informed and Secure

While the technical sophistication of LOSTKEYS and its delivery mechanisms is concerning, the best defense remains vigilance. Users should be cautious when prompted to run unfamiliar commands or interact with unexpected web forms. Organizations, especially those dealing in sensitive data or policy, should continue to invest in training, endpoint protection, and threat intelligence.

LOSTKEYS is a reminder that modern threats often come in subtle packages. It's not the noise-makers but the quiet operators that may pose the greatest risk to security in the digital age.