anydeskrce-something/infostealer-threat-intel-2025-2026.md

Infostealer Threat Intelligence Report: 2025-2026

Defensive Research - Per-Family Technical Analysis

Date: March 2026 Purpose: Understanding modern stealer techniques for detection and defense

---

Table of Contents

1. Executive Summary
2. Chrome App-Bound Encryption Bypass Taxonomy
3. Per-Family Analysis
   • Lumma Stealer (LummaC2)
   • StealC v2
   • Vidar 2.0
   • Rhadamanthys
   • Meduza Stealer
   • Amatera (ACR Stealer rebrand)
   • AuraStealer
   • Katz Stealer
   • EDDIESTEALER
   • Hannibal Stealer
   • Phemedrone
   • Skuld (TMPN)
   • WhiteSnake
   • SantaStealer
   • Logins.zip
4. Novel Techniques Unique to 2025-2026
5. Cross-Family Technique Matrix
6. Detection Opportunities

---

Executive Summary

In 2025-2026, infostealers became the fastest-growing malware category, surpassing ransomware in deployment volume. Key statistics:

• 11.1 million machines infected in 2025 alone
• 3.3 billion credentials, cookies, and tokens stolen
• 1.8 billion credentials confirmed stolen from 5.8 million devices
• 54% of ransomware victims had domains in stealer dumps (Verizon DBIR)
• 183 million Gmail credentials leaked in Oct 2025 from a single campaign
• StealC, Lumma, and RedLine accounted for 75% of infections in 2024; by 2026 the landscape fragmented significantly after Lumma takedown

The market shifted toward data-as-a-service (DaaS) subscription models, with stolen data packaged, hosted, and resold on premium invite-only forums (Exploit, RAMP, XSS).

---

Chrome App-Bound Encryption Bypass Taxonomy

Google introduced App-Bound Encryption (ABE) in Chrome 127 (July 2024). Bypasses emerged within 45 days. The following distinct bypass approaches are used across families:

Approach 1: COM-Based IElevator Service (SYSTEM-Level Decryption)

• Elevate to SYSTEM, then call GoogleChromeElevationService COM interface's DecryptData method
• Used by: Glove Stealer, Meduza, WhiteSnake, early Lumma variants
• Requires: SYSTEM privileges or elevation exploit
• Detection: Monitor COM calls to GoogleChromeElevationService, unusual SYSTEM-level access to Chrome user data

Approach 2: Chrome Remote Debug Protocol (DevTools)

• Launch Chrome with --remote-debugging-port=9222 --window-position=-9999,-9999 (off-screen)
• Connect via WebSocket, call deprecated Network.getAllCookies CDP method
• Used by: Phemedrone, Xenostealer, some StealC variants
• Requires: Ability to launch Chrome process
• Detection: Chrome.exe launched with --remote-debugging-port, WebSocket connections to localhost:9222

Approach 3: Process Injection into Running Chrome

• Inject shellcode/DLL into chrome.exe process via remote thread injection or reflective DLL injection
• Extract encryption keys from active browser memory before ABE applies
• Used by: Vidar 2.0, Lumma (later variants), Hannibal Stealer
• Requires: Running Chrome process
• Detection: Code injection into chrome.exe (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread targeting chrome.exe), named pipe communication

Approach 4: DLL Injection for Key Extraction

• Inject DLL that calls Chrome's internal decryption functions from within Chrome's context
• Used by: Katz Stealer
• Requires: No admin privileges (runs as user)
• Detection: Unusual DLL loads in Chrome process, DLL injection signatures

Approach 5: Headless Chrome Launch + Debug Injection

• Launch browser headlessly with debugging enabled, inject code into the running process
• Two-stage: First try traditional DPAPI, then escalate to memory injection
• Used by: Vidar 2.0 (fallback chain)
• Detection: Chrome launched with --headless and debug flags simultaneously

Approach 6: Chromium Zero-Day Chain

• Exploit undisclosed Chromium vulnerabilities chained with ABE bypass + DPAPI server-side decryption
• Claims 99% credential recovery vs. ~43% for legacy DPAPI-only methods
• Used by: Logins.zip (claimed, unverified)
• Requires: No admin; ~150KB stub with polymorphic obfuscation

Approach 7: Early Bird APC Injection

• Use Early Bird APC injection technique for fileless ABE bypass
• Used by: DumpBrowserSecrets tool
• Detection: APC injection patterns, NtQueueApcThread calls

Approach 8: Fileless In-Memory Module Loading

• Load Chrome decryptor DLL entirely in memory, never touching disk
• Used by: SantaStealer
• Detection: Memory-only module loads, suspicious memory allocations without corresponding file I/O

Google's response: Planning replacement of ABE with Device Bound Session Credentials (DBSC), binding sessions to device-unique cryptographic keys.

---

Per-Family Analysis

---

1. Lumma Stealer (LummaC2)

Attribute	Detail
Language	C/C++
Developer	Storm-2477 (Microsoft tracking)
Model	MaaS: $250/mo standard, $1,000/mo premium, $20,000 source code
Status	Disrupted by law enforcement May 2025; resurgent by Oct 2025 with improved capabilities

Extraction Techniques:

• Browsers: Chrome, Firefox, Edge, Brave - passwords, autofill, history, session cookies
• Crypto: Binance, Electrum, Ethereum, MetaMask wallets
• Apps: Email clients, 2FA extensions, FTP clients

Evasion Techniques:

• Remote thread injection from MicrosoftEdgeUpdate.exe into legitimate chrome.exe processes
• AutoIT scripts to hide and execute shellcode
• Code injection into legitimate system processes
• Advanced browser fingerprinting for C2 communication evasion (new in late 2025)
• Browser fingerprinting collects system/network/hardware/browser data via JavaScript payloads

Chrome ABE Bypass: Approach 3 (process injection into chrome.exe from trusted edge update process)

Exfiltration: HTTP-based C2 with browser fingerprinting layer for C2 evasion

Novel/Unique Techniques:

• Browser fingerprinting as C2 tactic (supplementing traditional C2 protocols)
• EtherHiding: Hosting malicious code in Binance Smart Chain smart contracts
• ClickFix delivery: Fake CAPTCHA verification pages
• Injection from MicrosoftEdgeUpdate.exe (trusted process) into chrome.exe

Detection Opportunities:

• MicrosoftEdgeUpdate.exe performing remote thread injection
• Chrome.exe with injected threads from external processes
• Outbound traffic with browser fingerprinting patterns to non-Google domains
• BSC smart contract calls from non-crypto applications

---

2. StealC v2

Attribute	Detail
Language	C/C++ (new codebase in v2)
Model	MaaS with customizable builder
Status	Active, v2 released early 2025

Extraction Techniques:

• 23+ browsers with server-side decryption of credentials
• 100+ web plugins and extensions
• 15+ desktop crypto wallets
• Messaging: Telegram, Discord, Tox, Pidgin
• VPN clients: ProtonVPN, OpenVPN
• Mail: Thunderbird

Evasion Techniques:

• Themida commercial packer (heavy obfuscation)
• RC4 encryption for all strings with hardcoded key
• Encrypted network traffic (JSON-based protocol with RC4)
• Server-side decryption (sensitive operations happen on C2, not on victim)

Chrome ABE Bypass: Server-side decryption approach - sends encrypted data to C2 for decryption rather than decrypting locally

Exfiltration: JSON-based C2 protocol with RC4 encryption; supports Telegram bot notifications

Payload Delivery: EXE, MSI packages, PowerShell scripts

Novel/Unique Techniques:

• Server-side credential decryption - most browsers decrypted on the C2 server, not the victim machine
• Rule-based payload delivery - operator customizes payloads based on geolocation, HWID, installed software
• Integrated builder in control panel for per-target customization

Detection Opportunities:

• Themida-packed binaries performing browser data access
• RC4-encrypted JSON traffic patterns
• MSI package execution followed by browser credential file access
• Large outbound data transfers with RC4-like entropy patterns

---

3. Vidar 2.0

Attribute	Detail
Language	Pure C (complete rewrite from C++)
Developer	"Loadbaks"
Model	MaaS: $300 lifetime
Status	Released Oct 6, 2025; rapidly adopted after Lumma decline

Extraction Techniques:

• Browser cookies, autofill, credentials from all major browsers
• Crypto wallet extensions and desktop apps
• Cloud credentials
• Steam accounts
• Telegram and Discord data

Evasion Techniques:

• Polymorphic builder - generates unique binary signatures per build
• Control flow flattening - obfuscates execution path
• Multi-threaded architecture (adapts thread count to hardware)
• Extensive anti-analysis: debugger detection, timing verification, system uptime validation, hardware profiling
• Immediate termination on any check failure

Chrome ABE Bypass: Approach 3+5 (two-stage):

1. First attempts traditional DPAPI decryption from Local State files
2. On failure, launches browsers with debugging enabled
3. Injects shellcode or reflective DLL into running browser processes
4. Extracts encryption keys from active browser memory via named pipes
5. Developer claims "unique appBound methods not found in the public domain"

Exfiltration: HTTP-based C2

Novel/Unique Techniques:

• Pure C rewrite eliminating C++ runtime overhead (performance + smaller footprint)
• Adaptive multi-threading - spawns more threads on higher-end systems for faster harvest
• Two-stage ABE bypass chain with graceful fallback
• Reflective DLL injection + named pipe key exfiltration from browser process
• Positioned to fill Lumma's market gap with aggressive $300 lifetime pricing

Detection Opportunities:

• Chrome/Edge/Brave launched with debugging flags by non-user process
• Named pipe creation associated with browser processes
• Reflective DLL injection patterns (VirtualAllocEx + WriteProcessMemory + CreateRemoteThread into browser)
• High-entropy polymorphic binaries with control flow flattening artifacts
• Rapid sequential access to multiple browser profile directories

---

4. Rhadamanthys (v0.9.x)

Attribute	Detail
Language	C/C++ with Lua plugin system
Model	MaaS: $299-$499/month
Status	Active, v0.9.2 as of 2025

Extraction Techniques:

• Browser passwords, autofill, cookies, credit cards (Chrome, Firefox)
• Crypto wallets: MetaMask, Exodus, Electrum
• System files: Documents under 20MB (PDFs, text, Word)
• Email and messaging apps

Evasion Techniques:

• Username check against sandbox naming patterns
• HWID comparison against predefined list
• Steganographic payload delivery - payloads hidden in WAV, JPEG, or PNG files
• Shared-secret decryption negotiated during C2 handshake
• FastLZ compression for C2 URL data
• Customized Base64 character set for obfuscation
• CPUID-based VM detection via instruction timing (RDTSC comparison)
• CoffeeLoader delivery chain

Chrome ABE Bypass: Via CoffeeLoader integration; specific method varies per deployment

Exfiltration: C2 with encrypted channel; payload download via steganographic images

Novel/Unique Techniques:

• Lua plugin runtime - extensible data theft via Lua scripts (unique among stealers)
• AI-powered OCR (v0.7.0+) - optical character recognition for capturing crypto wallet seed phrases from images/screenshots
• Steganographic payload concealment in common image/audio formats with shared-secret decryption
• Device and browser fingerprinting via Lua plugins
• FastLZ + custom Base64 obfuscation layers

Detection Opportunities:

• Image/audio file downloads followed by suspicious memory operations (steganography extraction)
• Lua interpreter loaded by unknown processes
• CPUID instruction timing checks (anti-VM)
• Unusual document file access patterns (scanning files <20MB)
• CoffeeLoader behavior chain

---

5. Meduza Stealer

Attribute	Detail
Language	C++ (stealer), Python (C2 panel)
Model	MaaS
Status	Active, updated in 2025

Extraction Techniques:

• 100+ browsers
• Crypto wallets: MetaMask, TrustWallet, Coinbase, OKX, Enrypt (new in 2025)
• Messengers: Telegram, Discord
• Password managers: 1Password, LastPass
• Email clients: Outlook
• Google Account token extraction (new 2025)

Evasion Techniques:

• CPUID-based VM detection
• GeoID-based geo-restriction (terminates in CIS countries)
• Encoding + encryption for payload protection
• Optimized crypting stub (2025 update)
• Improved AV evasion

Privilege Escalation:

• COM object execution for elevation
• SeDebugPrivilege token modification

Chrome ABE Bypass: Approach 1 (COM-based IElevator service)

Exfiltration: Early C2 connection (unlike most stealers that collect first, connect later)

Novel/Unique Techniques:

• Early C2 connection - establishes C2 before data collection (unusual pattern)
• Google Account token extraction - direct Google account compromise
• Privilege escalation via COM objects - not just data theft but system-level access
• SeDebugPrivilege token manipulation for elevated access

Detection Opportunities:

• COM object instantiation for privilege escalation
• SeDebugPrivilege token manipulation
• Early outbound C2 connection before any file/browser access
• CPUID instruction execution patterns
• GeoID API calls at startup

---

6. Amatera Stealer (ACR Stealer Rebrand)

Attribute	Detail
Language	C++
Developer	SheldIO (original ACR); source code sold 2024
Model	MaaS: $199/mo to $1,499/year
Status	Active since June 2025

Extraction Techniques:

• Crypto wallets, browsers, messaging apps, FTP clients, email services
• Saved passwords, credit cards, history across Chrome, Firefox, Brave, Edge, Opera

Evasion Techniques:

• WoW64 SysCalls - direct syscalls via WoW64 transition gate to bypass user-mode hooks
• NTSockets via \Device\Afd\Endpoint - raw TCP networking bypassing ws2_32.dll and all Winsock APIs
• SSN extraction by scanning for mov eax, imm32 (opcode B8) in ntdll
• Dynamic API resolution
• Anti-sandbox, anti-EDR by design

Chrome ABE Bypass: Integrated with broader credential theft; specific technique not documented but likely server-side

Exfiltration: Direct AFD device communication (NTSockets), bypassing all Windows networking API monitoring

Novel/Unique Techniques (HIGHLY SIGNIFICANT):

• NTSockets implementation - communicates directly with \Device\Afd\Endpoint using NtCreateFile and NtDeviceIoControlFile, completely bypassing ws2_32, WinHTTP, WinInet, and all commonly monitored networking APIs
• WoW64 direct syscalls - executes sensitive operations through the WoW64 transition gate, bypassing all user-mode hooks from EDR/sandbox
• SSN dynamic extraction - scans ntdll for syscall numbers at runtime
• Combined, these techniques make Amatera nearly invisible to API-hooking-based security products

Detection Opportunities:

• Direct \Device\Afd\Endpoint access via NtCreateFile (rare in legitimate software)
• WoW64 syscall transition patterns
• NtDeviceIoControlFile calls with AFD IOCTL codes
• Process accessing browser credential files without using standard networking APIs
• Heaven's Gate transitions in 32-bit processes

---

7. AuraStealer

Attribute	Detail
Language	C++
Model	MaaS on Russian-language forums since July 2025
Status	Active, 48+ C2 domains identified

Extraction Techniques:

• 110+ browsers
• 70+ applications (wallets, 2FA tools)
• 250+ browser extensions
• Customizable collection scope via configuration

Evasion Techniques:

• Indirect control-flow obfuscation - all jumps/calls replaced with indirect variants calculated at runtime
• Exception-driven API hashing - triggers access violations deliberately, resolves APIs through custom exception handlers
• Stack-based XOR string encryption
• Heaven's Gate for NTDLL calls (32-bit to 64-bit transition)
• Anti-tampering via PE header checksum verification
• Breakpoint detection on return addresses
• Hidden stack corruption when hooks or breakpoints are detected (anti-debug trap)
• Constant obfuscation

Chrome ABE Bypass: Likely integrated; positioned as LummaC2 successor

Exfiltration: TLS-based C2 communication

Novel/Unique Techniques:

• Exception-driven API resolution - one of the most sophisticated API hiding techniques seen in stealers
• Hidden stack corruption on hook detection - rather than just terminating, corrupts the stack to crash analysis tools
• Heaven's Gate integration for mixing 32/64-bit execution
• Return address breakpoint detection - checks if return addresses have breakpoints set (anti-reverse-engineering)
• Build size only 500-700KB despite massive feature set

Detection Opportunities:

• Exception-heavy execution flow (high volume of handled access violations)
• Heaven's Gate transitions (far calls to 64-bit code segments from 32-bit processes)
• PE checksum validation at runtime
• Stack corruption patterns in crashed analysis tools
• TikTok/social platform distribution chains

---

8. Katz Stealer

Attribute	Detail
Language	Not specified (likely C/C++)
Developer	katzadmin (BreachForums)
Model	MaaS: $100/month (budget option)
Status	Active since April 2025

Extraction Techniques:

• Browsers, crypto wallets, messaging platforms, gaming services
• Aggressive credential theft with system fingerprinting

Evasion Techniques:

• UAC bypass via cmstp.exe (trusted Microsoft binary abuse)
• Process hollowing via MSBuild.exe (another trusted binary)
• In-memory execution
• CIS country check (language-based geofencing)
• Stealthy persistence mechanisms

Chrome ABE Bypass: Approach 4 - DLL injection to obtain encryption key without administrator privileges, then decrypts cookies/passwords from Chromium browsers

Exfiltration: C2-based

Novel/Unique Techniques:

• Non-admin ABE bypass via DLL injection (key differentiator)
• MSBuild.exe process hollowing - using trusted development tool as host
• cmstp.exe UAC bypass - leveraging Microsoft Connection Manager
• Budget pricing ($100/mo) driving rapid adoption

Detection Opportunities:

• MSBuild.exe with unusual child processes or network activity
• cmstp.exe executing outside of normal VPN/connection contexts
• DLL injection into Chrome without admin privileges
• Process hollowing signatures in MSBuild.exe

---

9. EDDIESTEALER

Attribute	Detail
Language	Rust
Model	Commodity stealer
Status	Active 2025

Extraction Techniques:

• System metadata collection
• Crypto wallets, web browsers, password managers
• FTP clients, messaging apps
• Task-based architecture (receives theft tasks from C2)

Evasion Techniques:

• Rust compilation (harder to analyze than C/C++)
• ClickFix delivery via fake CAPTCHA pages
• Task-based execution model

Chrome ABE Bypass: Confirmed capability; method not fully documented

Exfiltration: C2 task-response model

Novel/Unique Techniques:

• Rust-based stealer - relatively uncommon language choice providing natural obfuscation
• Task-based architecture - C2 sends specific theft tasks rather than pre-programmed theft sequence
• ClickFix/fake CAPTCHA delivery chain

Detection Opportunities:

• Rust binary characteristics (unique PE structure, large imports)
• Task-based C2 communication patterns
• ClickFix page delivery detection

---

10. Hannibal Stealer

Attribute	Detail
Language	C# (.NET Framework)
Model	MaaS: $150/mo to $650/7mo; ~10,000 Telegram subscribers
Status	Active since February 2025

Extraction Techniques:

• Chromium + Gecko browsers (credentials, cookies, autofill)
• Crypto wallets: Exodus, MetaMask, Monero, etc.
• FTP: FileZilla, Total Commander
• VPN credentials, Steam sessions, Telegram files, Discord tokens
• Crypto clipper module (clipboard hijacking for wallet address replacement)

Evasion Techniques:

• Impersonation of legitimate browser DLLs (e.g., CefSharp.BrowserSubprocess.dll)
• DLL injection using multiple different DLLs
• Trusted process masquerading

Chrome ABE Bypass: Approach 3 - Injects code into Chrome's memory space, retrieves plaintext session cookies directly from within Chrome's process. Captures cookies from memory enabling session hijack without credentials or MFA bypass.

Exfiltration: C2-based

Novel/Unique Techniques:

• Legitimate DLL impersonation - uses known browser component DLL names
• Direct memory cookie capture - grabs plaintext cookies pre-encryption from Chrome's process memory
• Crypto clipper integrated with stealer (dual-purpose)
• Evolution from Sharp Stealer -> TX Stealer -> Hannibal Stealer lineage

Detection Opportunities:

• CefSharp.BrowserSubprocess.dll loaded by non-browser processes
• Multiple DLL injection events targeting browser processes
• Clipboard monitoring for crypto address replacement patterns
• .NET assembly loading patterns

---

11. Phemedrone Stealer

Attribute	Detail
Language	C# (open source)
Model	Free/open source (distributed via Telegram, formerly GitHub)
Status	Active with regular updates

Extraction Techniques:

• Chromium + Gecko browser data (cookies, passwords, autofill, credit cards)
• Sessions: Telegram, Steam, Discord
• Crypto wallets
• Screenshots and system information

Evasion Techniques:

• VM detection via WMI (VirtualBox, VMware, Hyper-V string matching)
• Mutex checker for singular execution
• Configurable anti-analysis, anti-VM, anti-debugger modules

Chrome ABE Bypass: Approach 2 - Chrome Remote Debug Protocol with off-screen window positioning (--window-position=-9999,-9999), WebSocket connection to localhost:9222, calls deprecated Network.getAllCookies

Exfiltration: HTTP-based log system

Novel/Unique Techniques:

• Open source - freely available, highly customizable
• CVE-2023-36025 exploitation (Windows SmartScreen bypass for delivery)
• Off-screen Chrome debugging - positions window at -9999,-9999 to hide from user

Detection Opportunities:

• Chrome launched with --remote-debugging-port and extreme negative window positions
• WebSocket connections to localhost:9222
• WMI queries checking for VM identifiers
• SmartScreen bypass attempts

---

12. Skuld (TMPN Stealer)

Attribute	Detail
Language	Golang 1.20+
Developer	"Deathined"
Model	Open source / freely available
Status	Active, still under development

Extraction Techniques:

• Discord tokens (primary focus)
• 37 Chromium-based browser logins, cookies, credit cards, history
• Crypto wallets with clipper module
• System information

Evasion Techniques:

• Go compilation (14.4MB binaries, harder for traditional AV)
• Fake compilation timestamps
• Discord Token Protector corruption (disables protection before stealing)

Chrome ABE Bypass: Not specifically documented; likely uses standard DPAPI

Exfiltration: Discord webhooks (primary)

Novel/Unique Techniques:

• Golang-based - ported from Python PoCs to Go for cross-platform potential and AV evasion
• Discord Token Protector corruption - actively sabotages defensive tools
• Better Discord file corruption + JavaScript injection into Discord client
• Discord invite link hijacking for distribution

Detection Opportunities:

• Large Go binaries (~14MB) accessing browser credential files
• Discord Token Protector file modifications
• JavaScript injection into Discord's local app files
• Discord webhook exfiltration traffic

---

13. WhiteSnake Stealer

Attribute	Detail
Language	Not specified (likely C#)
Model	MaaS: $120/mo to $1,500 lifetime
Status	Active

Extraction Techniques:

• Browsers (cookies, autofill, login data)
• Crypto wallet browser extensions
• Messaging: Discord, Pidgin, Steam, Telegram
• Mail: Thunderbird
• FTP: FileZilla
• Remote access: Snowflake
• Screenshots, audio recording, webcam capture, keylogging

Evasion Techniques:

• Mutex-based single instance
• TOR for C2 communication (unique among stealers)

Chrome ABE Bypass: Confirmed bypass capability (one of the first to announce)

Exfiltration: TOR-based C2 (distinguishing feature)

Novel/Unique Techniques:

• TOR C2 communication - provides network-level anonymity rare in stealers
• Full RAT capabilities (screenshots, audio, webcam, keylogging) integrated with stealer
• Cross-platform (Windows + Linux)

Detection Opportunities:

• TOR traffic from non-TOR-browser processes
• Combined stealer + RAT behavioral patterns
• Audio/webcam access by unknown processes

---

14. SantaStealer

Attribute	Detail
Language	64-bit DLL (500+ exports)
Developer	Evolved from BluelineStealer
Model	MaaS: $175/mo basic, $300/mo premium
Status	Active since December 2025

Extraction Techniques:

• Browser credentials, cookies, stored passwords
• Crypto wallet data
• Telegram, Discord, Steam tokens

Evasion Techniques:

• Fileless operation - modules and Chrome decryptor DLL loaded/executed entirely in memory
• Anti-VM checks (exported as check_antivm)
• However: unencrypted strings, descriptive export names (immature OpSec)

Chrome ABE Bypass: Approach 8 - Fileless in-memory Chrome decryptor DLL loading

Exfiltration: Compressed data split into 10MB chunks over unencrypted HTTP (weak OpSec)

Novel/Unique Techniques:

• Completely fileless collection - no credential files ever touch disk
• In-memory Chrome decryptor - DLL loaded and executed without file creation
• Technically immature but conceptually advanced (fileless approach is the future direction)

Detection Opportunities:

• Memory-only DLL loads without disk backing
• 10MB chunked HTTP uploads
• Unencrypted HTTP exfiltration (easy to detect)
• Exported symbols like "payload_main", "check_antivm", "browser_names" in loaded modules

---

15. Logins.zip

Attribute	Detail
Language	C
Model	MaaS: $150/mo (promotional)
Status	Active since October 2025

Extraction Techniques:

• Multi-browser: Chrome, Brave, Edge, Firefox, Opera
• Cookies, credentials, payment card details

Evasion Techniques:

• Polymorphic auto-obfuscation (each build unique)
• ~150KB stub size (extremely small)
• Browser-based builder (no technical expertise required)

Chrome ABE Bypass: Approach 6 - Claims two undisclosed Chromium zero-day exploits chained with ABE bypass + server-side DPAPI decryption. Claims 99% credential recovery vs. ~43% for legacy DPAPI-only stealers. No admin privileges required.

Exfiltration: C2 with server-side decryption

Novel/Unique Techniques:

• Claimed Chromium zero-day integration (if real, most advanced ABE bypass)
• Server-side DPAPI decryption combined with browser exploits
• 150KB stub - one of the smallest stealer payloads known
• Polymorphic auto-obfuscation built into every generated stub
• 99% credential recovery claim (vs. 43% industry average)
• Browser-based builder lowering the barrier to entry

Detection Opportunities:

• Extremely small executable (~150KB) accessing browser credential stores
• Polymorphic binary characteristics
• Server-side decryption traffic patterns
• Dashboard/panel infrastructure indicators

---

Novel Techniques Unique to 2025-2026

1. NTSockets / Direct AFD Communication (Amatera)

Bypasses ALL Windows networking APIs by communicating directly with \Device\Afd\Endpoint via NtCreateFile + NtDeviceIoControlFile. Makes HTTP traffic invisible to API-hooking security products.

2. AI-Powered OCR for Seed Phrase Capture (Rhadamanthys)

Uses optical character recognition to scan screenshots and images for cryptocurrency wallet seed phrases - a completely novel data theft vector.

3. Browser Fingerprinting as C2 Tactic (Lumma)

Uses JavaScript-based browser fingerprinting not just for anti-analysis but as an actual C2 communication channel supplement.

4. EtherHiding / Blockchain C2 (Lumma)

Stores malicious code in Binance Smart Chain smart contracts, making C2 infrastructure essentially immutable and takedown-resistant.

5. Server-Side Credential Decryption (StealC v2, Logins.zip)

Shifts decryption workload to the C2 server, reducing on-victim forensic artifacts and removing the need for local crypto libraries.

6. Steganographic Payload Delivery (Rhadamanthys)

Payloads hidden in WAV/JPEG/PNG files with shared-secret decryption negotiated during C2 handshake.

7. Exception-Driven API Hashing (AuraStealer)

Deliberately triggers access violations and resolves API calls through custom exception handlers - extremely difficult to analyze statically.

8. Fileless Collection Pipeline (SantaStealer)

Chrome decryptor DLL loaded and executed entirely in memory with no disk artifacts.

9. WoW64 Syscall + NTSocket Combined Evasion (Amatera)

Combines Heaven's Gate transitions with direct AFD socket communication to bypass both API hooks and network monitoring simultaneously.

10. Adaptive Multi-Threading (Vidar 2.0)

Dynamically adjusts thread count based on victim hardware to minimize dwell time on faster systems.

11. Polymorphic Builder with Control Flow Flattening (Vidar 2.0)

Each build has unique binary signatures AND flattened control flow, defeating both signature and structural analysis.

12. Hidden Stack Corruption Anti-Debug (AuraStealer)

Instead of terminating when hooks are detected, corrupts the stack to crash the analysis tool - actively hostile to researchers.

13. Chromium Zero-Day + DPAPI Chain (Logins.zip)

If legitimate, represents the first known integration of browser zero-days specifically for credential theft (vs. traditional exploit->RCE chains).

14. ClickFix / Fake CAPTCHA Epidemic

Near-universal adoption of "verify you're human" fake CAPTCHA pages as the primary delivery mechanism across almost all families.

15. Trusted Binary Abuse Chain (Katz)

MSBuild.exe (process hollowing) + cmstp.exe (UAC bypass) - chaining two trusted binaries for defense evasion without any custom exploit.

---

Cross-Family Technique Matrix

Family	Language	ABE Bypass	Exfil Method	Anti-VM	Anti-Debug	Packer/Obfuscation	Novel Feature
Lumma	C/C++	Process injection	HTTP + fingerprint	Yes	Yes	AutoIT	EtherHiding, browser FP C2
StealC v2	C/C++	Server-side decrypt	RC4 JSON C2	Yes	Yes	Themida	Server-side decryption
Vidar 2.0	Pure C	Debug inject + DLL	HTTP C2	Yes	Yes	Polymorphic + CFF	Adaptive multithreading
Rhadamanthys	C++ + Lua	Via CoffeeLoader	Encrypted C2	RDTSC timing	HWID check	FastLZ + custom B64	AI OCR, steganography
Meduza	C++/Python	IElevator COM	Early C2	CPUID	COM escalation	Crypting stub	Google token theft
Amatera	C++	Integrated	NTSocket/AFD	Yes	WoW64 syscall	Dynamic API	NTSocket evasion
AuraStealer	C++	Integrated	TLS C2	Yes	Stack corruption	Exception-driven hash	Heaven's Gate + exception API
Katz	C/C++	DLL inject (no admin)	C2	CIS geocheck	MSBuild hollow	In-memory	Budget MaaS ($100/mo)
EDDIESTEALER	Rust	Confirmed	Task-based C2	Unknown	Unknown	Rust natural	Task-based architecture
Hannibal	C# .NET	Memory injection	C2	Unknown	DLL masquerade	Legit DLL names	Memory cookie capture
Phemedrone	C#	Chrome DevTools	HTTP logs	WMI VM check	Mutex	Configurable	Open source, CVE delivery
Skuld	Golang	DPAPI (basic)	Discord webhook	Fake timestamps	Go obfuscation	Go compilation	Discord sabotage
WhiteSnake	C#	Confirmed	TOR	Unknown	Mutex	TOR integration	Full RAT + TOR
SantaStealer	Native DLL	Fileless in-memory	HTTP (unencrypted)	check_antivm	Basic	Fileless	In-memory decryptor
Logins.zip	C	Chromium 0-day chain	Server-side decrypt	Unknown	Unknown	Polymorphic auto	150KB stub, 99% recovery

---

Detection Opportunities

High-Value Detection Signals (Across All Families)

Browser Process Injection:

• VirtualAllocEx/WriteProcessMemory/CreateRemoteThread targeting chrome.exe, msedge.exe, brave.exe, firefox.exe
• Non-browser DLLs loaded into browser processes
• Named pipe creation associated with browser processes

Chrome Debug Protocol Abuse:

• Chrome launched with --remote-debugging-port by non-developer processes
• Chrome launched with --headless + debug flags
• Window positions at extreme negative coordinates (-9999,-9999)
• WebSocket connections to localhost:9222

ABE Bypass Indicators:

• COM calls to GoogleChromeElevationService from non-Chrome processes
• Direct access to Chrome's Local State file by unknown processes
• DLL injection into Chrome without corresponding user interaction

Credential File Access Patterns:

• Rapid sequential access to multiple browser profile directories
• Access to Login Data, Cookies, Web Data SQLite files by non-browser processes
• Local State file reads followed by DPAPI calls

Network-Level:

• TOR traffic from non-TOR processes (WhiteSnake)
• RC4-encrypted JSON payloads (StealC v2)
• Direct \Device\Afd\Endpoint access (Amatera)
• 10MB chunked HTTP uploads (SantaStealer)
• Discord webhook POST requests with base64/encoded data
• Telegram API calls (api.telegram.org) from non-Telegram processes

Anti-Analysis Behavioral:

• CPUID/RDTSC timing loops at process start
• WMI queries for VM identifiers
• GeoID/language checks followed by process termination
• High volume of handled access violations (exception-driven API hashing)
• Heaven's Gate far calls from 32-bit processes

Persistence Indicators:

• Registry Run key modifications by recently-created executables
• Scheduled tasks with 3-minute repeat intervals
• MSBuild.exe or cmstp.exe with unusual child processes
• Task.xml dropped to establish scheduled tasks

Delivery Chain:

• ClickFix/fake CAPTCHA pages in browser history
• EtherHiding (BSC smart contract calls from non-crypto apps)
• PowerShell one-liners from "copy-paste" social engineering
• SVG attachments in phishing emails
• Malicious .blend files (targeting Blender users)

---

Key Trends Summary

1. ABE bypass is solved - Every major stealer has at least one working bypass. Google's ABE is no longer a meaningful defense. DBSC is the planned replacement.

2. Language diversification - Pure C (Vidar), Rust (EDDIESTEALER), Golang (Skuld), C# (Hannibal/Phemedrone), C++ (most others). Each language provides different evasion properties.

3. Server-side processing - StealC v2 and Logins.zip shift decryption to C2, reducing victim-side artifacts.

4. Fileless evolution - SantaStealer's in-memory-only approach will likely become standard.

5. API-level evasion maturity - Amatera's NTSocket + WoW64 syscall combination and AuraStealer's exception-driven API hashing represent the cutting edge of EDR bypass.

6. ClickFix delivery dominance - Fake CAPTCHA "verify you're human" pages are now the dominant delivery mechanism.

7. Market fragmentation - After Lumma's takedown and RedLine/META's disruption, the market splintered into many competing families, driving innovation and price competition.

8. Pricing race to bottom - From $1,000+/mo for premium features to $100/mo (Katz) and $300 lifetime (Vidar 2.0), making advanced stealers accessible to low-skill actors.

---

Sources compiled from Microsoft Security Blog, Trend Micro, Elastic Security Labs, Proofpoint, Rapid7, Check Point Research, Zscaler ThreatLabz, Picus Security, Gen Digital, CrowdStrike, ANY.RUN, CYFIRMA, SpyCloud, and others. March 2026.