New Stealit Malware Exploits Node.js Extensions to Target Windows Systems

Security researchers have identified a new, active campaign of the Stealit malware that uses an experimental Node.js feature to infect Windows systems.

According to a report from FortiGuard Labs, threat actors are leveraging Node.js’s Single Executable Application (SEA) functionality to package and distribute their malicious payloads. This updated tactic marks a shift from previous Stealit versions that relied on the Electron framework.

The malware is being distributed through file-sharing platforms like Mediafire and Discord, disguised as installers for popular games and VPN software.

The discovery came after security analysts noticed a spike in detections of a Visual Basic script used by the malware to establish persistence on compromised machines.

The use of SEA allows the malware to run as a standalone binary without requiring a pre-installed Node.js runtime, making it a versatile distribution method for the attackers.

Stealit Malware Exploits Node.js Extensions

The operators behind Stealit are running a sophisticated Malware-as-a-Service (MaaS) business, marketing their creation on a public-facing website.

The site, which has recently moved between domains to evade takedowns, promotes Stealit as a “professional data extraction solution” and offers various subscription plans.

For approximately $500, a customer can purchase a lifetime license for the Windows version, while the Android variant is priced at around $2,000.

The website details the malware’s extensive capabilities, which include typical Remote Access Trojan (RAT) functions such as remote file access, webcam hijacking, live screen monitoring, and even a module for deploying ransomware.

The service is also promoted through a public Telegram channel, where the operators post updates and interact with potential clients, showcasing the professional and commercial nature of this cybercrime operation.

Key features advertised by Stealit operators include:

• Live screen viewing and webcam access for real-time surveillance.
• System management capabilities including remote shutdown and restart.
• Command execution through a built-in terminal interface.
• File extraction from critical directories like Desktop and Documents.
• Ransomware deployment with direct victim communication channels.
• Fake alert message generation to deceive users.
• Remote audio playback and wallpaper modification capabilities.

Sophisticated Evasion Techniques

The latest version of Stealit is engineered with multiple layers of obfuscation and anti-analysis features designed to thwart detection and hinder research. The attack begins when a user runs the initial installer.

This triggers a multi-stage process where heavily obscured scripts are decoded and executed in memory. Before deploying its main payloads, the malware conducts a series of rigorous checks to determine if it is running within a virtual machine or a security analysis environment.

It inspects system memory, CPU core count, hostnames, running processes, and registry keys for any signs of sandboxing or debugging tools.

If any such artifacts are detected, the malware immediately terminates its execution and displays a fake error message.

This robust defense mechanism allows it to remain undetected on the victim’s system before it proceeds with the installation.

Anti-analysis techniques employed by Stealit:

• Virtual environment detection through hardware and system checks.
• Process monitoring to identify debugging and analysis tools.
• Registry inspection for security software artifacts.
• Network port scanning to detect monitoring systems.
• DLL injection analysis to identify loaded security modules.
• Parent process verification to avoid researcher environments.
• Timing analysis to detect sandboxed execution environments.

Extensive Data Theft Capabilities

After successfully bypassing security checks, the malware downloads several components from its command-and-control (C2) server to carry out its primary mission of data theft.

To avoid detection by endpoint security products, it adds its installation directories to the Windows Defender exclusion list.

One of its key components, save_data.exe, utilizes an open-source tool called ChromElevator to extract sensitive information, such as saved credentials and cookies, from Chromium-based browsers.

Another module, stats_db.exe, is designed to steal data from a wide array of applications, including messengers like Telegram and WhatsApp, gaming platforms like Steam and Epic Games, and various cryptocurrency wallets.

Demonstrating their agility, the threat actors were observed reverting to the Electron framework within weeks, this time adding AES-256-GCM encryption to their scripts, indicating this is a rapidly evolving and persistent threat.

Indicators of Compromise (IoCs):

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.