anydeskrce-something/infostealer-threat-intel-2025-2026.md

# Infostealer Threat Intelligence Report: 2025-2026
## Defensive Research - Per-Family Technical Analysis

**Date**: March 2026
**Purpose**: Understanding modern stealer techniques for detection and defense

---

## Table of Contents
1. [Executive Summary](#executive-summary)
2. [Chrome App-Bound Encryption Bypass Taxonomy](#chrome-abe-bypass-taxonomy)
3. [Per-Family Analysis](#per-family-analysis)
   - Lumma Stealer (LummaC2)
   - StealC v2
   - Vidar 2.0
   - Rhadamanthys
   - Meduza Stealer
   - Amatera (ACR Stealer rebrand)
   - AuraStealer
   - Katz Stealer
   - EDDIESTEALER
   - Hannibal Stealer
   - Phemedrone
   - Skuld (TMPN)
   - WhiteSnake
   - SantaStealer
   - Logins.zip
4. [Novel Techniques Unique to 2025-2026](#novel-techniques)
5. [Cross-Family Technique Matrix](#technique-matrix)
6. [Detection Opportunities](#detection-opportunities)

---

## Executive Summary

In 2025-2026, infostealers became the **fastest-growing malware category**, surpassing ransomware in deployment volume. Key statistics:
- **11.1 million** machines infected in 2025 alone
- **3.3 billion** credentials, cookies, and tokens stolen
- **1.8 billion** credentials confirmed stolen from 5.8 million devices
- **54%** of ransomware victims had domains in stealer dumps (Verizon DBIR)
- **183 million** Gmail credentials leaked in Oct 2025 from a single campaign
- StealC, Lumma, and RedLine accounted for **75%** of infections in 2024; by 2026 the landscape fragmented significantly after Lumma takedown

The market shifted toward **data-as-a-service (DaaS)** subscription models, with stolen data packaged, hosted, and resold on premium invite-only forums (Exploit, RAMP, XSS).

---

## Chrome App-Bound Encryption Bypass Taxonomy

Google introduced App-Bound Encryption (ABE) in Chrome 127 (July 2024). Bypasses emerged **within 45 days**. The following distinct bypass approaches are used across families:

### Approach 1: COM-Based IElevator Service (SYSTEM-Level Decryption)
- Elevate to SYSTEM, then call `GoogleChromeElevationService` COM interface's `DecryptData` method
- Used by: **Glove Stealer, Meduza, WhiteSnake, early Lumma variants**
- Requires: SYSTEM privileges or elevation exploit
- Detection: Monitor COM calls to `GoogleChromeElevationService`, unusual SYSTEM-level access to Chrome user data

### Approach 2: Chrome Remote Debug Protocol (DevTools)
- Launch Chrome with `--remote-debugging-port=9222 --window-position=-9999,-9999` (off-screen)
- Connect via WebSocket, call deprecated `Network.getAllCookies` CDP method
- Used by: **Phemedrone, Xenostealer, some StealC variants**
- Requires: Ability to launch Chrome process
- Detection: Chrome.exe launched with `--remote-debugging-port`, WebSocket connections to localhost:9222

### Approach 3: Process Injection into Running Chrome
- Inject shellcode/DLL into chrome.exe process via remote thread injection or reflective DLL injection
- Extract encryption keys from active browser memory before ABE applies
- Used by: **Vidar 2.0, Lumma (later variants), Hannibal Stealer**
- Requires: Running Chrome process
- Detection: Code injection into chrome.exe (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread targeting chrome.exe), named pipe communication

### Approach 4: DLL Injection for Key Extraction
- Inject DLL that calls Chrome's internal decryption functions from within Chrome's context
- Used by: **Katz Stealer**
- Requires: No admin privileges (runs as user)
- Detection: Unusual DLL loads in Chrome process, DLL injection signatures

### Approach 5: Headless Chrome Launch + Debug Injection
- Launch browser headlessly with debugging enabled, inject code into the running process
- Two-stage: First try traditional DPAPI, then escalate to memory injection
- Used by: **Vidar 2.0 (fallback chain)**
- Detection: Chrome launched with `--headless` and debug flags simultaneously

### Approach 6: Chromium Zero-Day Chain
- Exploit undisclosed Chromium vulnerabilities chained with ABE bypass + DPAPI server-side decryption
- Claims 99% credential recovery vs. ~43% for legacy DPAPI-only methods
- Used by: **Logins.zip** (claimed, unverified)
- Requires: No admin; ~150KB stub with polymorphic obfuscation

### Approach 7: Early Bird APC Injection
- Use Early Bird APC injection technique for fileless ABE bypass
- Used by: **DumpBrowserSecrets** tool
- Detection: APC injection patterns, NtQueueApcThread calls

### Approach 8: Fileless In-Memory Module Loading
- Load Chrome decryptor DLL entirely in memory, never touching disk
- Used by: **SantaStealer**
- Detection: Memory-only module loads, suspicious memory allocations without corresponding file I/O

**Google's response**: Planning replacement of ABE with **Device Bound Session Credentials (DBSC)**, binding sessions to device-unique cryptographic keys.

---

## Per-Family Analysis

---

### 1. Lumma Stealer (LummaC2)

| Attribute | Detail |
|-----------|--------|
| **Language** | C/C++ |
| **Developer** | Storm-2477 (Microsoft tracking) |
| **Model** | MaaS: $250/mo standard, $1,000/mo premium, $20,000 source code |
| **Status** | Disrupted by law enforcement May 2025; resurgent by Oct 2025 with improved capabilities |

**Extraction Techniques:**
- Browsers: Chrome, Firefox, Edge, Brave - passwords, autofill, history, session cookies
- Crypto: Binance, Electrum, Ethereum, MetaMask wallets
- Apps: Email clients, 2FA extensions, FTP clients

**Evasion Techniques:**
- Remote thread injection from `MicrosoftEdgeUpdate.exe` into legitimate `chrome.exe` processes
- AutoIT scripts to hide and execute shellcode
- Code injection into legitimate system processes
- Advanced browser fingerprinting for C2 communication evasion (new in late 2025)
- Browser fingerprinting collects system/network/hardware/browser data via JavaScript payloads

**Chrome ABE Bypass:** Approach 3 (process injection into chrome.exe from trusted edge update process)

**Exfiltration:** HTTP-based C2 with browser fingerprinting layer for C2 evasion

**Novel/Unique Techniques:**
- **Browser fingerprinting as C2 tactic** (supplementing traditional C2 protocols)
- **EtherHiding**: Hosting malicious code in Binance Smart Chain smart contracts
- **ClickFix delivery**: Fake CAPTCHA verification pages
- Injection from `MicrosoftEdgeUpdate.exe` (trusted process) into `chrome.exe`

**Detection Opportunities:**
- MicrosoftEdgeUpdate.exe performing remote thread injection
- Chrome.exe with injected threads from external processes
- Outbound traffic with browser fingerprinting patterns to non-Google domains
- BSC smart contract calls from non-crypto applications

---

### 2. StealC v2

| Attribute | Detail |
|-----------|--------|
| **Language** | C/C++ (new codebase in v2) |
| **Model** | MaaS with customizable builder |
| **Status** | Active, v2 released early 2025 |

**Extraction Techniques:**
- 23+ browsers with **server-side decryption** of credentials
- 100+ web plugins and extensions
- 15+ desktop crypto wallets
- Messaging: Telegram, Discord, Tox, Pidgin
- VPN clients: ProtonVPN, OpenVPN
- Mail: Thunderbird

**Evasion Techniques:**
- Themida commercial packer (heavy obfuscation)
- RC4 encryption for all strings with hardcoded key
- Encrypted network traffic (JSON-based protocol with RC4)
- Server-side decryption (sensitive operations happen on C2, not on victim)

**Chrome ABE Bypass:** Server-side decryption approach - sends encrypted data to C2 for decryption rather than decrypting locally

**Exfiltration:** JSON-based C2 protocol with RC4 encryption; supports Telegram bot notifications

**Payload Delivery:** EXE, MSI packages, PowerShell scripts

**Novel/Unique Techniques:**
- **Server-side credential decryption** - most browsers decrypted on the C2 server, not the victim machine
- **Rule-based payload delivery** - operator customizes payloads based on geolocation, HWID, installed software
- **Integrated builder** in control panel for per-target customization

**Detection Opportunities:**
- Themida-packed binaries performing browser data access
- RC4-encrypted JSON traffic patterns
- MSI package execution followed by browser credential file access
- Large outbound data transfers with RC4-like entropy patterns

---

### 3. Vidar 2.0

| Attribute | Detail |
|-----------|--------|
| **Language** | Pure C (complete rewrite from C++) |
| **Developer** | "Loadbaks" |
| **Model** | MaaS: $300 lifetime |
| **Status** | Released Oct 6, 2025; rapidly adopted after Lumma decline |

**Extraction Techniques:**
- Browser cookies, autofill, credentials from all major browsers
- Crypto wallet extensions and desktop apps
- Cloud credentials
- Steam accounts
- Telegram and Discord data

**Evasion Techniques:**
- **Polymorphic builder** - generates unique binary signatures per build
- **Control flow flattening** - obfuscates execution path
- Multi-threaded architecture (adapts thread count to hardware)
- Extensive anti-analysis: debugger detection, timing verification, system uptime validation, hardware profiling
- Immediate termination on any check failure

**Chrome ABE Bypass:** Approach 3+5 (two-stage):
1. First attempts traditional DPAPI decryption from Local State files
2. On failure, launches browsers with debugging enabled
3. Injects shellcode or reflective DLL into running browser processes
4. Extracts encryption keys from active browser memory via named pipes
5. Developer claims "unique appBound methods not found in the public domain"

**Exfiltration:** HTTP-based C2

**Novel/Unique Techniques:**
- **Pure C rewrite** eliminating C++ runtime overhead (performance + smaller footprint)
- **Adaptive multi-threading** - spawns more threads on higher-end systems for faster harvest
- **Two-stage ABE bypass chain** with graceful fallback
- **Reflective DLL injection + named pipe** key exfiltration from browser process
- Positioned to fill Lumma's market gap with aggressive $300 lifetime pricing

**Detection Opportunities:**
- Chrome/Edge/Brave launched with debugging flags by non-user process
- Named pipe creation associated with browser processes
- Reflective DLL injection patterns (VirtualAllocEx + WriteProcessMemory + CreateRemoteThread into browser)
- High-entropy polymorphic binaries with control flow flattening artifacts
- Rapid sequential access to multiple browser profile directories

---

### 4. Rhadamanthys (v0.9.x)

| Attribute | Detail |
|-----------|--------|
| **Language** | C/C++ with Lua plugin system |
| **Model** | MaaS: $299-$499/month |
| **Status** | Active, v0.9.2 as of 2025 |

**Extraction Techniques:**
- Browser passwords, autofill, cookies, credit cards (Chrome, Firefox)
- Crypto wallets: MetaMask, Exodus, Electrum
- System files: Documents under 20MB (PDFs, text, Word)
- Email and messaging apps

**Evasion Techniques:**
- Username check against sandbox naming patterns
- HWID comparison against predefined list
- **Steganographic payload delivery** - payloads hidden in WAV, JPEG, or PNG files
- Shared-secret decryption negotiated during C2 handshake
- FastLZ compression for C2 URL data
- Customized Base64 character set for obfuscation
- CPUID-based VM detection via instruction timing (RDTSC comparison)
- CoffeeLoader delivery chain

**Chrome ABE Bypass:** Via CoffeeLoader integration; specific method varies per deployment

**Exfiltration:** C2 with encrypted channel; payload download via steganographic images

**Novel/Unique Techniques:**
- **Lua plugin runtime** - extensible data theft via Lua scripts (unique among stealers)
- **AI-powered OCR** (v0.7.0+) - optical character recognition for capturing crypto wallet seed phrases from images/screenshots
- **Steganographic payload concealment** in common image/audio formats with shared-secret decryption
- **Device and browser fingerprinting** via Lua plugins
- **FastLZ + custom Base64** obfuscation layers

**Detection Opportunities:**
- Image/audio file downloads followed by suspicious memory operations (steganography extraction)
- Lua interpreter loaded by unknown processes
- CPUID instruction timing checks (anti-VM)
- Unusual document file access patterns (scanning files <20MB)
- CoffeeLoader behavior chain

---

### 5. Meduza Stealer

| Attribute | Detail |
|-----------|--------|
| **Language** | C++ (stealer), Python (C2 panel) |
| **Model** | MaaS |
| **Status** | Active, updated in 2025 |

**Extraction Techniques:**
- 100+ browsers
- Crypto wallets: MetaMask, TrustWallet, Coinbase, OKX, Enrypt (new in 2025)
- Messengers: Telegram, Discord
- Password managers: 1Password, LastPass
- Email clients: Outlook
- **Google Account token extraction** (new 2025)

**Evasion Techniques:**
- CPUID-based VM detection
- GeoID-based geo-restriction (terminates in CIS countries)
- Encoding + encryption for payload protection
- Optimized crypting stub (2025 update)
- Improved AV evasion

**Privilege Escalation:**
- COM object execution for elevation
- SeDebugPrivilege token modification

**Chrome ABE Bypass:** Approach 1 (COM-based IElevator service)

**Exfiltration:** Early C2 connection (unlike most stealers that collect first, connect later)

**Novel/Unique Techniques:**
- **Early C2 connection** - establishes C2 before data collection (unusual pattern)
- **Google Account token extraction** - direct Google account compromise
- **Privilege escalation via COM objects** - not just data theft but system-level access
- **SeDebugPrivilege** token manipulation for elevated access

**Detection Opportunities:**
- COM object instantiation for privilege escalation
- SeDebugPrivilege token manipulation
- Early outbound C2 connection before any file/browser access
- CPUID instruction execution patterns
- GeoID API calls at startup

---

### 6. Amatera Stealer (ACR Stealer Rebrand)

| Attribute | Detail |
|-----------|--------|
| **Language** | C++ |
| **Developer** | SheldIO (original ACR); source code sold 2024 |
| **Model** | MaaS: $199/mo to $1,499/year |
| **Status** | Active since June 2025 |

**Extraction Techniques:**
- Crypto wallets, browsers, messaging apps, FTP clients, email services
- Saved passwords, credit cards, history across Chrome, Firefox, Brave, Edge, Opera

**Evasion Techniques:**
- **WoW64 SysCalls** - direct syscalls via WoW64 transition gate to bypass user-mode hooks
- **NTSockets via \Device\Afd\Endpoint** - raw TCP networking bypassing ws2_32.dll and all Winsock APIs
- SSN extraction by scanning for `mov eax, imm32` (opcode B8) in ntdll
- Dynamic API resolution
- Anti-sandbox, anti-EDR by design

**Chrome ABE Bypass:** Integrated with broader credential theft; specific technique not documented but likely server-side

**Exfiltration:** Direct AFD device communication (NTSockets), bypassing all Windows networking API monitoring

**Novel/Unique Techniques (HIGHLY SIGNIFICANT):**
- **NTSockets implementation** - communicates directly with `\Device\Afd\Endpoint` using NtCreateFile and NtDeviceIoControlFile, completely bypassing ws2_32, WinHTTP, WinInet, and all commonly monitored networking APIs
- **WoW64 direct syscalls** - executes sensitive operations through the WoW64 transition gate, bypassing all user-mode hooks from EDR/sandbox
- **SSN dynamic extraction** - scans ntdll for syscall numbers at runtime
- Combined, these techniques make Amatera nearly **invisible to API-hooking-based security products**

**Detection Opportunities:**
- Direct `\Device\Afd\Endpoint` access via NtCreateFile (rare in legitimate software)
- WoW64 syscall transition patterns
- NtDeviceIoControlFile calls with AFD IOCTL codes
- Process accessing browser credential files without using standard networking APIs
- Heaven's Gate transitions in 32-bit processes

---

### 7. AuraStealer

| Attribute | Detail |
|-----------|--------|
| **Language** | C++ |
| **Model** | MaaS on Russian-language forums since July 2025 |
| **Status** | Active, 48+ C2 domains identified |

**Extraction Techniques:**
- 110+ browsers
- 70+ applications (wallets, 2FA tools)
- 250+ browser extensions
- Customizable collection scope via configuration

**Evasion Techniques:**
- **Indirect control-flow obfuscation** - all jumps/calls replaced with indirect variants calculated at runtime
- **Exception-driven API hashing** - triggers access violations deliberately, resolves APIs through custom exception handlers
- **Stack-based XOR string encryption**
- **Heaven's Gate** for NTDLL calls (32-bit to 64-bit transition)
- Anti-tampering via PE header checksum verification
- Breakpoint detection on return addresses
- **Hidden stack corruption** when hooks or breakpoints are detected (anti-debug trap)
- Constant obfuscation

**Chrome ABE Bypass:** Likely integrated; positioned as LummaC2 successor

**Exfiltration:** TLS-based C2 communication

**Novel/Unique Techniques:**
- **Exception-driven API resolution** - one of the most sophisticated API hiding techniques seen in stealers
- **Hidden stack corruption on hook detection** - rather than just terminating, corrupts the stack to crash analysis tools
- **Heaven's Gate** integration for mixing 32/64-bit execution
- **Return address breakpoint detection** - checks if return addresses have breakpoints set (anti-reverse-engineering)
- Build size only 500-700KB despite massive feature set

**Detection Opportunities:**
- Exception-heavy execution flow (high volume of handled access violations)
- Heaven's Gate transitions (far calls to 64-bit code segments from 32-bit processes)
- PE checksum validation at runtime
- Stack corruption patterns in crashed analysis tools
- TikTok/social platform distribution chains

---

### 8. Katz Stealer

| Attribute | Detail |
|-----------|--------|
| **Language** | Not specified (likely C/C++) |
| **Developer** | katzadmin (BreachForums) |
| **Model** | MaaS: $100/month (budget option) |
| **Status** | Active since April 2025 |

**Extraction Techniques:**
- Browsers, crypto wallets, messaging platforms, gaming services
- Aggressive credential theft with system fingerprinting

**Evasion Techniques:**
- **UAC bypass via cmstp.exe** (trusted Microsoft binary abuse)
- **Process hollowing via MSBuild.exe** (another trusted binary)
- In-memory execution
- CIS country check (language-based geofencing)
- Stealthy persistence mechanisms

**Chrome ABE Bypass:** Approach 4 - DLL injection to obtain encryption key **without administrator privileges**, then decrypts cookies/passwords from Chromium browsers

**Exfiltration:** C2-based

**Novel/Unique Techniques:**
- **Non-admin ABE bypass** via DLL injection (key differentiator)
- **MSBuild.exe process hollowing** - using trusted development tool as host
- **cmstp.exe UAC bypass** - leveraging Microsoft Connection Manager
- Budget pricing ($100/mo) driving rapid adoption

**Detection Opportunities:**
- MSBuild.exe with unusual child processes or network activity
- cmstp.exe executing outside of normal VPN/connection contexts
- DLL injection into Chrome without admin privileges
- Process hollowing signatures in MSBuild.exe

---

### 9. EDDIESTEALER

| Attribute | Detail |
|-----------|--------|
| **Language** | **Rust** |
| **Model** | Commodity stealer |
| **Status** | Active 2025 |

**Extraction Techniques:**
- System metadata collection
- Crypto wallets, web browsers, password managers
- FTP clients, messaging apps
- Task-based architecture (receives theft tasks from C2)

**Evasion Techniques:**
- Rust compilation (harder to analyze than C/C++)
- ClickFix delivery via fake CAPTCHA pages
- Task-based execution model

**Chrome ABE Bypass:** Confirmed capability; method not fully documented

**Exfiltration:** C2 task-response model

**Novel/Unique Techniques:**
- **Rust-based stealer** - relatively uncommon language choice providing natural obfuscation
- **Task-based architecture** - C2 sends specific theft tasks rather than pre-programmed theft sequence
- ClickFix/fake CAPTCHA delivery chain

**Detection Opportunities:**
- Rust binary characteristics (unique PE structure, large imports)
- Task-based C2 communication patterns
- ClickFix page delivery detection

---

### 10. Hannibal Stealer

| Attribute | Detail |
|-----------|--------|
| **Language** | C# (.NET Framework) |
| **Model** | MaaS: $150/mo to $650/7mo; ~10,000 Telegram subscribers |
| **Status** | Active since February 2025 |

**Extraction Techniques:**
- Chromium + Gecko browsers (credentials, cookies, autofill)
- Crypto wallets: Exodus, MetaMask, Monero, etc.
- FTP: FileZilla, Total Commander
- VPN credentials, Steam sessions, Telegram files, Discord tokens
- **Crypto clipper module** (clipboard hijacking for wallet address replacement)

**Evasion Techniques:**
- Impersonation of legitimate browser DLLs (e.g., `CefSharp.BrowserSubprocess.dll`)
- DLL injection using multiple different DLLs
- Trusted process masquerading

**Chrome ABE Bypass:** Approach 3 - Injects code into Chrome's memory space, retrieves plaintext session cookies directly from within Chrome's process. Captures cookies from memory enabling session hijack **without credentials or MFA bypass**.

**Exfiltration:** C2-based

**Novel/Unique Techniques:**
- **Legitimate DLL impersonation** - uses known browser component DLL names
- **Direct memory cookie capture** - grabs plaintext cookies pre-encryption from Chrome's process memory
- **Crypto clipper** integrated with stealer (dual-purpose)
- Evolution from Sharp Stealer -> TX Stealer -> Hannibal Stealer lineage

**Detection Opportunities:**
- CefSharp.BrowserSubprocess.dll loaded by non-browser processes
- Multiple DLL injection events targeting browser processes
- Clipboard monitoring for crypto address replacement patterns
- .NET assembly loading patterns

---

### 11. Phemedrone Stealer

| Attribute | Detail |
|-----------|--------|
| **Language** | C# (open source) |
| **Model** | Free/open source (distributed via Telegram, formerly GitHub) |
| **Status** | Active with regular updates |

**Extraction Techniques:**
- Chromium + Gecko browser data (cookies, passwords, autofill, credit cards)
- Sessions: Telegram, Steam, Discord
- Crypto wallets
- Screenshots and system information

**Evasion Techniques:**
- VM detection via WMI (VirtualBox, VMware, Hyper-V string matching)
- Mutex checker for singular execution
- Configurable anti-analysis, anti-VM, anti-debugger modules

**Chrome ABE Bypass:** Approach 2 - Chrome Remote Debug Protocol with off-screen window positioning (`--window-position=-9999,-9999`), WebSocket connection to `localhost:9222`, calls deprecated `Network.getAllCookies`

**Exfiltration:** HTTP-based log system

**Novel/Unique Techniques:**
- **Open source** - freely available, highly customizable
- **CVE-2023-36025 exploitation** (Windows SmartScreen bypass for delivery)
- **Off-screen Chrome debugging** - positions window at -9999,-9999 to hide from user

**Detection Opportunities:**
- Chrome launched with `--remote-debugging-port` and extreme negative window positions
- WebSocket connections to localhost:9222
- WMI queries checking for VM identifiers
- SmartScreen bypass attempts

---

### 12. Skuld (TMPN Stealer)

| Attribute | Detail |
|-----------|--------|
| **Language** | **Golang 1.20+** |
| **Developer** | "Deathined" |
| **Model** | Open source / freely available |
| **Status** | Active, still under development |

**Extraction Techniques:**
- Discord tokens (primary focus)
- 37 Chromium-based browser logins, cookies, credit cards, history
- Crypto wallets with clipper module
- System information

**Evasion Techniques:**
- Go compilation (14.4MB binaries, harder for traditional AV)
- Fake compilation timestamps
- Discord Token Protector corruption (disables protection before stealing)

**Chrome ABE Bypass:** Not specifically documented; likely uses standard DPAPI

**Exfiltration:** Discord webhooks (primary)

**Novel/Unique Techniques:**
- **Golang-based** - ported from Python PoCs to Go for cross-platform potential and AV evasion
- **Discord Token Protector corruption** - actively sabotages defensive tools
- **Better Discord file corruption** + JavaScript injection into Discord client
- **Discord invite link hijacking** for distribution

**Detection Opportunities:**
- Large Go binaries (~14MB) accessing browser credential files
- Discord Token Protector file modifications
- JavaScript injection into Discord's local app files
- Discord webhook exfiltration traffic

---

### 13. WhiteSnake Stealer

| Attribute | Detail |
|-----------|--------|
| **Language** | Not specified (likely C#) |
| **Model** | MaaS: $120/mo to $1,500 lifetime |
| **Status** | Active |

**Extraction Techniques:**
- Browsers (cookies, autofill, login data)
- Crypto wallet browser extensions
- Messaging: Discord, Pidgin, Steam, Telegram
- Mail: Thunderbird
- FTP: FileZilla
- Remote access: Snowflake
- Screenshots, audio recording, webcam capture, keylogging

**Evasion Techniques:**
- Mutex-based single instance
- **TOR for C2 communication** (unique among stealers)

**Chrome ABE Bypass:** Confirmed bypass capability (one of the first to announce)

**Exfiltration:** **TOR-based C2** (distinguishing feature)

**Novel/Unique Techniques:**
- **TOR C2 communication** - provides network-level anonymity rare in stealers
- **Full RAT capabilities** (screenshots, audio, webcam, keylogging) integrated with stealer
- Cross-platform (Windows + Linux)

**Detection Opportunities:**
- TOR traffic from non-TOR-browser processes
- Combined stealer + RAT behavioral patterns
- Audio/webcam access by unknown processes

---

### 14. SantaStealer

| Attribute | Detail |
|-----------|--------|
| **Language** | 64-bit DLL (500+ exports) |
| **Developer** | Evolved from BluelineStealer |
| **Model** | MaaS: $175/mo basic, $300/mo premium |
| **Status** | Active since December 2025 |

**Extraction Techniques:**
- Browser credentials, cookies, stored passwords
- Crypto wallet data
- Telegram, Discord, Steam tokens

**Evasion Techniques:**
- **Fileless operation** - modules and Chrome decryptor DLL loaded/executed entirely in memory
- Anti-VM checks (exported as `check_antivm`)
- However: unencrypted strings, descriptive export names (immature OpSec)

**Chrome ABE Bypass:** Approach 8 - Fileless in-memory Chrome decryptor DLL loading

**Exfiltration:** Compressed data split into 10MB chunks over **unencrypted HTTP** (weak OpSec)

**Novel/Unique Techniques:**
- **Completely fileless collection** - no credential files ever touch disk
- **In-memory Chrome decryptor** - DLL loaded and executed without file creation
- Technically immature but conceptually advanced (fileless approach is the future direction)

**Detection Opportunities:**
- Memory-only DLL loads without disk backing
- 10MB chunked HTTP uploads
- Unencrypted HTTP exfiltration (easy to detect)
- Exported symbols like "payload_main", "check_antivm", "browser_names" in loaded modules

---

### 15. Logins.zip

| Attribute | Detail |
|-----------|--------|
| **Language** | C |
| **Model** | MaaS: $150/mo (promotional) |
| **Status** | Active since October 2025 |

**Extraction Techniques:**
- Multi-browser: Chrome, Brave, Edge, Firefox, Opera
- Cookies, credentials, payment card details

**Evasion Techniques:**
- **Polymorphic auto-obfuscation** (each build unique)
- ~150KB stub size (extremely small)
- Browser-based builder (no technical expertise required)

**Chrome ABE Bypass:** Approach 6 - Claims **two undisclosed Chromium zero-day exploits** chained with ABE bypass + server-side DPAPI decryption. Claims 99% credential recovery vs. ~43% for legacy DPAPI-only stealers. No admin privileges required.

**Exfiltration:** C2 with server-side decryption

**Novel/Unique Techniques:**
- **Claimed Chromium zero-day integration** (if real, most advanced ABE bypass)
- **Server-side DPAPI decryption** combined with browser exploits
- **150KB stub** - one of the smallest stealer payloads known
- **Polymorphic auto-obfuscation** built into every generated stub
- **99% credential recovery** claim (vs. 43% industry average)
- Browser-based builder lowering the barrier to entry

**Detection Opportunities:**
- Extremely small executable (~150KB) accessing browser credential stores
- Polymorphic binary characteristics
- Server-side decryption traffic patterns
- Dashboard/panel infrastructure indicators

---

## Novel Techniques Unique to 2025-2026

### 1. NTSockets / Direct AFD Communication (Amatera)
Bypasses ALL Windows networking APIs by communicating directly with `\Device\Afd\Endpoint` via NtCreateFile + NtDeviceIoControlFile. Makes HTTP traffic invisible to API-hooking security products.

### 2. AI-Powered OCR for Seed Phrase Capture (Rhadamanthys)
Uses optical character recognition to scan screenshots and images for cryptocurrency wallet seed phrases - a completely novel data theft vector.

### 3. Browser Fingerprinting as C2 Tactic (Lumma)
Uses JavaScript-based browser fingerprinting not just for anti-analysis but as an actual C2 communication channel supplement.

### 4. EtherHiding / Blockchain C2 (Lumma)
Stores malicious code in Binance Smart Chain smart contracts, making C2 infrastructure essentially immutable and takedown-resistant.

### 5. Server-Side Credential Decryption (StealC v2, Logins.zip)
Shifts decryption workload to the C2 server, reducing on-victim forensic artifacts and removing the need for local crypto libraries.

### 6. Steganographic Payload Delivery (Rhadamanthys)
Payloads hidden in WAV/JPEG/PNG files with shared-secret decryption negotiated during C2 handshake.

### 7. Exception-Driven API Hashing (AuraStealer)
Deliberately triggers access violations and resolves API calls through custom exception handlers - extremely difficult to analyze statically.

### 8. Fileless Collection Pipeline (SantaStealer)
Chrome decryptor DLL loaded and executed entirely in memory with no disk artifacts.

### 9. WoW64 Syscall + NTSocket Combined Evasion (Amatera)
Combines Heaven's Gate transitions with direct AFD socket communication to bypass both API hooks and network monitoring simultaneously.

### 10. Adaptive Multi-Threading (Vidar 2.0)
Dynamically adjusts thread count based on victim hardware to minimize dwell time on faster systems.

### 11. Polymorphic Builder with Control Flow Flattening (Vidar 2.0)
Each build has unique binary signatures AND flattened control flow, defeating both signature and structural analysis.

### 12. Hidden Stack Corruption Anti-Debug (AuraStealer)
Instead of terminating when hooks are detected, corrupts the stack to crash the analysis tool - actively hostile to researchers.

### 13. Chromium Zero-Day + DPAPI Chain (Logins.zip)
If legitimate, represents the first known integration of browser zero-days specifically for credential theft (vs. traditional exploit->RCE chains).

### 14. ClickFix / Fake CAPTCHA Epidemic
Near-universal adoption of "verify you're human" fake CAPTCHA pages as the primary delivery mechanism across almost all families.

### 15. Trusted Binary Abuse Chain (Katz)
MSBuild.exe (process hollowing) + cmstp.exe (UAC bypass) - chaining two trusted binaries for defense evasion without any custom exploit.

---

## Cross-Family Technique Matrix

| Family | Language | ABE Bypass | Exfil Method | Anti-VM | Anti-Debug | Packer/Obfuscation | Novel Feature |
|--------|----------|-----------|-------------|---------|-----------|-------------------|---------------|
| Lumma | C/C++ | Process injection | HTTP + fingerprint | Yes | Yes | AutoIT | EtherHiding, browser FP C2 |
| StealC v2 | C/C++ | Server-side decrypt | RC4 JSON C2 | Yes | Yes | Themida | Server-side decryption |
| Vidar 2.0 | Pure C | Debug inject + DLL | HTTP C2 | Yes | Yes | Polymorphic + CFF | Adaptive multithreading |
| Rhadamanthys | C++ + Lua | Via CoffeeLoader | Encrypted C2 | RDTSC timing | HWID check | FastLZ + custom B64 | AI OCR, steganography |
| Meduza | C++/Python | IElevator COM | Early C2 | CPUID | COM escalation | Crypting stub | Google token theft |
| Amatera | C++ | Integrated | NTSocket/AFD | Yes | WoW64 syscall | Dynamic API | NTSocket evasion |
| AuraStealer | C++ | Integrated | TLS C2 | Yes | Stack corruption | Exception-driven hash | Heaven's Gate + exception API |
| Katz | C/C++ | DLL inject (no admin) | C2 | CIS geocheck | MSBuild hollow | In-memory | Budget MaaS ($100/mo) |
| EDDIESTEALER | Rust | Confirmed | Task-based C2 | Unknown | Unknown | Rust natural | Task-based architecture |
| Hannibal | C# .NET | Memory injection | C2 | Unknown | DLL masquerade | Legit DLL names | Memory cookie capture |
| Phemedrone | C# | Chrome DevTools | HTTP logs | WMI VM check | Mutex | Configurable | Open source, CVE delivery |
| Skuld | Golang | DPAPI (basic) | Discord webhook | Fake timestamps | Go obfuscation | Go compilation | Discord sabotage |
| WhiteSnake | C# | Confirmed | **TOR** | Unknown | Mutex | TOR integration | Full RAT + TOR |
| SantaStealer | Native DLL | Fileless in-memory | HTTP (unencrypted) | check_antivm | Basic | Fileless | In-memory decryptor |
| Logins.zip | C | Chromium 0-day chain | Server-side decrypt | Unknown | Unknown | Polymorphic auto | 150KB stub, 99% recovery |

---

## Detection Opportunities

### High-Value Detection Signals (Across All Families)

**Browser Process Injection:**
- VirtualAllocEx/WriteProcessMemory/CreateRemoteThread targeting chrome.exe, msedge.exe, brave.exe, firefox.exe
- Non-browser DLLs loaded into browser processes
- Named pipe creation associated with browser processes

**Chrome Debug Protocol Abuse:**
- Chrome launched with `--remote-debugging-port` by non-developer processes
- Chrome launched with `--headless` + debug flags
- Window positions at extreme negative coordinates (-9999,-9999)
- WebSocket connections to localhost:9222

**ABE Bypass Indicators:**
- COM calls to `GoogleChromeElevationService` from non-Chrome processes
- Direct access to Chrome's `Local State` file by unknown processes
- DLL injection into Chrome without corresponding user interaction

**Credential File Access Patterns:**
- Rapid sequential access to multiple browser profile directories
- Access to `Login Data`, `Cookies`, `Web Data` SQLite files by non-browser processes
- `Local State` file reads followed by DPAPI calls

**Network-Level:**
- TOR traffic from non-TOR processes (WhiteSnake)
- RC4-encrypted JSON payloads (StealC v2)
- Direct `\Device\Afd\Endpoint` access (Amatera)
- 10MB chunked HTTP uploads (SantaStealer)
- Discord webhook POST requests with base64/encoded data
- Telegram API calls (api.telegram.org) from non-Telegram processes

**Anti-Analysis Behavioral:**
- CPUID/RDTSC timing loops at process start
- WMI queries for VM identifiers
- GeoID/language checks followed by process termination
- High volume of handled access violations (exception-driven API hashing)
- Heaven's Gate far calls from 32-bit processes

**Persistence Indicators:**
- Registry Run key modifications by recently-created executables
- Scheduled tasks with 3-minute repeat intervals
- MSBuild.exe or cmstp.exe with unusual child processes
- Task.xml dropped to establish scheduled tasks

**Delivery Chain:**
- ClickFix/fake CAPTCHA pages in browser history
- EtherHiding (BSC smart contract calls from non-crypto apps)
- PowerShell one-liners from "copy-paste" social engineering
- SVG attachments in phishing emails
- Malicious .blend files (targeting Blender users)

---

## Key Trends Summary

1. **ABE bypass is solved** - Every major stealer has at least one working bypass. Google's ABE is no longer a meaningful defense. DBSC is the planned replacement.

2. **Language diversification** - Pure C (Vidar), Rust (EDDIESTEALER), Golang (Skuld), C# (Hannibal/Phemedrone), C++ (most others). Each language provides different evasion properties.

3. **Server-side processing** - StealC v2 and Logins.zip shift decryption to C2, reducing victim-side artifacts.

4. **Fileless evolution** - SantaStealer's in-memory-only approach will likely become standard.

5. **API-level evasion maturity** - Amatera's NTSocket + WoW64 syscall combination and AuraStealer's exception-driven API hashing represent the cutting edge of EDR bypass.

6. **ClickFix delivery dominance** - Fake CAPTCHA "verify you're human" pages are now the dominant delivery mechanism.

7. **Market fragmentation** - After Lumma's takedown and RedLine/META's disruption, the market splintered into many competing families, driving innovation and price competition.

8. **Pricing race to bottom** - From $1,000+/mo for premium features to $100/mo (Katz) and $300 lifetime (Vidar 2.0), making advanced stealers accessible to low-skill actors.

---

*Sources compiled from Microsoft Security Blog, Trend Micro, Elastic Security Labs, Proofpoint, Rapid7, Check Point Research, Zscaler ThreatLabz, Picus Security, Gen Digital, CrowdStrike, ANY.RUN, CYFIRMA, SpyCloud, and others. March 2026.*