The Blender Foundation’s ecosystem was exploited as an attack vector for distributing StealC V2 infostealer, a malware campaign tied to Russian-speaking threat actors. Over six months, malicious `.blend` files were uploaded to platforms like CGTrader, tricking users—primarily 3D artists and professionals—into downloading weaponized files. These files embedded Python scripts that auto-executed if Blender’s *Auto Run Python Scripts* setting was enabled, bypassing sandbox detection.The attack chain involved fetching a PowerShell loader, which deployed two ZIP archives: one containing StealC V2 (a Python-based stealer) and another auxiliary stealer. The malware targeted browsers (Chrome 132+), wallets (15+ types), VPNs (ProtonVPN, OpenVPN), messaging apps (Telegram, Discord), and email clients (Thunderbird), exfiltrating credentials, financial data, and sensitive files. Persistence was achieved via LNK files in the Windows Startup folder, while encrypted payloads were downloaded via a ChaCha20-encrypted C2 channel.The impact included compromised personal and professional data of users, potential financial fraud (via stolen wallet credentials), and reputational damage to the Blender community. While no direct breach of Blender Foundation’s infrastructure occurred, the supply-chain-style attack leveraged trust in its file format, risking long-term erosion of user confidence in third-party asset platforms. Morphisec’s anti-ransomware platform mitigated some infections, but the campaign’s low VirusTotal detection rates suggest widespread undetected compromises.
Source: https://cyberpress.org/stealc-v2-infostealer/
Blender cybersecurity rating report: https://www.rankiteo.com/company/blender-org
"id": "BLE0040600112525",
"linkid": "blender-org",
"type": "Cyber Attack",
"date": "11/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': ['Blender users',
'3D artists',
'developers downloading assets '
'from platforms like CGTrader'],
'industry': '3D graphics software',
'location': 'Netherlands',
'name': 'Blender Foundation',
'type': 'non-profit organization'},
{'industry': '3D asset trading',
'name': 'CGTrader',
'type': 'online marketplace'}],
'attack_vector': ['malicious file download',
'embedded Python scripts',
'auto-execution via Blender preferences',
'remote payload fetching',
'PowerShell-based deployment',
'LNK persistence'],
'customer_advisories': ['Blender users advised to disable Python script '
'auto-execution.',
'3D artists warned against downloading .blend files '
'from untrusted sources.'],
'data_breach': {'data_encryption': ['ChaCha20 (for payload encryption)'],
'data_exfiltration': ['likely (via Pyramid C2 module)'],
'personally_identifiable_information': ['yes (via '
'browser/extension '
'data)'],
'sensitivity_of_data': ['high (financial, personal, and '
'authentication data)'],
'type_of_data_compromised': ['credentials',
'browser cookies',
'cryptocurrency wallet data',
'VPN configurations',
'messaging app sessions',
'PII']},
'description': 'Blender Foundation files have recently become a favored '
'vector for delivering the StealC V2 infostealer, a '
'sophisticated malware campaign linked to Russian-speaking '
'threat actors. Over the past six months, attackers uploaded '
'malicious .blend files to popular 3D asset platforms like '
'CGTrader, tricking users into downloading and opening them. '
'These files exploit Blender’s ability to embed Python '
"scripts, which execute automatically if the 'Auto Run Python "
"Scripts' option is enabled. The attack chain involves "
'fetching a loader from a remote domain, downloading '
'PowerShell scripts, and deploying StealC V2 and auxiliary '
'stealers via ZIP archives extracted to %TEMP%. The malware '
'targets browsers, wallets, messaging apps, VPNs, and mail '
'clients, with updated UAC bypass techniques and low '
'VirusTotal detection rates. Morphisec’s anti-ransomware '
'platform has successfully mitigated these attacks using '
'proactive deception and behavioral interception.',
'impact': {'brand_reputation_impact': ['potential reputational damage to '
'Blender Foundation and 3D asset '
'platforms (e.g., CGTrader)'],
'data_compromised': ['browser credentials',
'wallet data',
'messaging app logs (Telegram, Discord)',
'VPN configurations',
'email client data (Thunderbird)',
'plugin/extension data'],
'identity_theft_risk': ['high (due to stolen credentials and PII)'],
'payment_information_risk': ['high (targeting desktop wallets and '
'browser-stored payment data)'],
'systems_affected': ['Windows machines with Blender installed',
'physical machines with GPUs for 3D '
'rendering']},
'initial_access_broker': {'backdoors_established': ['LNK files in Windows '
'Startup folder'],
'data_sold_on_dark_web': ['likely (given '
'infostealer '
'capabilities)'],
'entry_point': ['malicious .blend files on 3D asset '
'platforms (e.g., CGTrader)'],
'high_value_targets': ['cryptocurrency wallets',
'browser-stored credentials',
'VPN configurations'],
'reconnaissance_period': ['at least 6 months (prior '
'to April 2025)']},
'investigation_status': 'ongoing (active campaign as of 2025)',
'lessons_learned': ['Supply chain risks in open-source/3D asset ecosystems '
'can be exploited via trusted file formats (e.g., '
'.blend).',
'Auto-execution features in software (e.g., Python '
'scripts in Blender) pose significant security risks.',
'Low-tier malware (e.g., StealC V2) can evade traditional '
'detection with minimal VirusTotal visibility.',
'Proactive deception (e.g., Morphisec’s decoy '
'credentials) can effectively mitigate infostealer '
'campaigns.'],
'motivation': ['financial gain', 'data theft', 'credential harvesting'],
'post_incident_analysis': {'corrective_actions': ['Blender Foundation to '
'patch or disable '
'auto-execution by default.',
'3D asset platforms to '
'implement malware scanning '
'for uploads.',
'Users to adopt behavioral '
'security solutions (e.g., '
'Morphisec).'],
'root_causes': ['Lack of security controls for '
'Blender’s Python script '
'execution.',
'Trust in .blend files as a safe '
'format within the 3D community.',
'Inadequate vetting of uploads on '
'3D asset platforms.']},
'recommendations': ["Disable 'Auto Run Python Scripts' in Blender preferences "
'by default.',
'Implement sandboxing for 3D rendering workflows, '
'especially on GPU-equipped machines.',
'Monitor for unusual LNK files in %TEMP% and Startup '
'folders.',
'Deploy behavioral-based detection (e.g., Morphisec) to '
'counter signature-evasive malware.',
'Educate users on risks of downloading .blend files from '
'untrusted sources.',
'Audit 3D asset platforms (e.g., CGTrader) for malicious '
'uploads.'],
'references': [{'source': 'Morphisec Research'},
{'source': 'VirusTotal (StealC V2 samples)',
'url': 'https://www.virustotal.com'}],
'response': {'adaptive_behavioral_waf': ['Morphisec’s dynamic decoy '
'injection'],
'containment_measures': ['Morphisec’s proactive deception (decoy '
'credentials)',
'behavioral interception of malicious '
'processes'],
'remediation_measures': ['termination of malicious processes',
'prevention of data '
'exfiltration/persistence'],
'third_party_assistance': ['Morphisec (anti-ransomware '
'platform)']},
'threat_actor': ['Russian-speaking cybercriminals', 'low-tier threat actors'],
'title': 'StealC V2 Infostealer Campaign Targeting Blender Foundation Users '
'via Malicious .blend Files',
'type': ['malware', 'infostealer', 'supply chain attack'],
'vulnerability_exploited': ["Blender’s 'Auto Run Python Scripts' feature",
'lack of sandboxing for physical GPU-equipped '
'machines']}