This new malware has emerged from the dark web and is after your data

x
(Image credit: Shutterstock)

Experts have warned of a new information-stealing malware has been observed circulating around the dark web as it looks to gather new customers and victims alike.

Cybersecurity researchers from SEKOIA came across multiple ads, on different underground forums and Telegram groups promoting a new infostealer called Stealc.

Apparently, Stealc is not built from scratch, but is rather an upgrade to other, more popular infostealers, such as Vidar, Racoon, Mars, and Redline Stealer, having been first spotted in January 2023 but then gaining more traction the following month.

Weekly updates

Stealc was built, and is being advertised, by a threat actor going by the name “Plymouth”. It is currently at version 1.3.0, and it seems to be getting new tweaks and upgrades at least once a week. 

Some of the newly added features include a C2 URL randomizer, and improved logs searching and sorting system. Stealc was also seen sparing people from Ukraine. 

After further analyzing a sample of the infostealer, SEKOIA uncovered that it uses legitimate third-party DLLs, that it’s written C and abuses Windows API functions, that it’s lightweight (only 80KB), that it obfuscates most of its strings with RC4 and base64, and that it exfiltrates stolen files automatically (requiring no action from the threat actor). 

SEKOIA has also found Stealc to be able to steal data from 22 web browsers, 75 plugins, and 25 desktop wallets. 

Besides advertising it on the dark web, Plymouth was also busy deploying it to target endpoints. One of the ways they do it is by creating fake YouTube tutorials on how to crack software, and providing a link in the description which, instead of the advertised crack, deploys the infostealer.

So far, more than 40 C2 servers were discovered, leading the researchers to conclude Stealc is growing quite popular. The popularity, they speculate, comes from the fact that crooks that can access the admin panel can easily generate new stealer samples, thus increasing its range. 

SEKOIA believes Stealc can become quite popular as it can be adopted by low-level hackers, as well. 

Via: BleepingComputer

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Hands typing on a keyboard surrounded by security icons
Infostealers on the rise: the latest concern for organizational defenses
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
An American flag flying outside the US Capitol building against a blue sky
US military and defense contractors hit with Infostealer malware
A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
These fake macOS updates are actually just looking to spread malware
Ransomware
Microsoft uncovers sleuthy new XCSSET MacOS malware campaign
Ransomware
Microsoft spies a new and worrying macOS malware strain
Latest in Security
Data Breach
Thousands of healthcare records exposed online, including private patient information
China
Juniper patches security flaws which could have let hackers take over your router
Representational image depecting cybersecurity protection
GitLab has patched a host of worrying security issues
Ai tech, businessman show virtual graphic Global Internet connect Chatgpt Chat with AI, Artificial Intelligence.
AI agents can be hijacked to write and send phishing attacks
China
Volt Typhoon threat group had access to American utility networks for the best part of a year
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
Latest in News
A super close up image of the Google Gemini app in the Play Store
It's official: Google Assistant will be retired for phones this year, with Gemini taking over
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 16 (game #1147)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Sunday, March 16 (game #378)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Sunday, March 16 (game #644)
Three iPhone 16 handsets on show
Apple could launch an iPhone 17 Ultra this year – but we've heard these rumors before
Super Mario Odyssey
ChatGPT is the ultimate gaming tool - here's 4 ways you can use AI to help with your next playthrough