The creators of the Invicta Stealer, which has been identified by cybersecurity specialists, are quite active on social networking sites like Facebook and YouTube. Researchers from Cyble Research and Intelligence Labs (CRIL) have observed Invicta Stealer being marketed on Facebook to attract potential customers.
According to a GitHub post, stealer builders are being provided for free by malware developers. Users are prompted to enter a Discord webhook/server URL while building, and this URL acts as the C2. Attackers also have a YouTube channel where they post a tutorial with step-by-step instructions on how to use a building tool from a Github repository to generate the Invicta Stealer executable.