SantaStealer: A New Malware Targeting Browsers and Crypto Wallets

A new malware‑as‑a‑service (MaaS) operation called SantaStealer has recently surfaced on Telegram channels and underground hacker forums. Marketed as a stealthy, memory‑resident information stealer, the malware claims to evade traditional file‑based detection methods while extracting sensitive user data.

However, recent analysis by Rapid7 suggests that SantaStealer may be more hype than reality — at least in its current form.

A Rebranded Threat in the Making

According to Rapid7 researchers, SantaStealer appears to be a rebranding of an earlier project known as BluelineStealer. The developer — believed to be Russian‑speaking — is actively promoting the malware ahead of an anticipated launch later this year.

The stealer is offered as a subscription service with two pricing tiers:

• Basic plan: $175 per month
• Premium plan: $300 per month

Affiliates are provided access to a web‑based control panel where they can configure malware builds based on their targeting needs.

Not as Stealthy as Advertised

Despite being promoted as difficult to detect and analyze, Rapid7’s findings paint a different picture.

The samples observed so far are far from undetectable and contain unencrypted strings and symbol names, making analysis relatively straightforward.

This suggests that SantaStealer is still under development. Leaked samples containing debugging artifacts point to poor operational security, potentially undermining the malware’s effectiveness before it even reaches widespread use.

Modular Data Theft Capabilities

SantaStealer uses 14 separate data‑collection modules, each running in its own thread. These modules collect data, store it in memory, compress it into ZIP archives, and exfiltrate the information in 10 MB chunks to a hardcoded command‑and‑control (C2) server over port 6767.

Targeted Data Includes:

• Browser data (passwords, cookies, history, saved credit cards)
• Messaging platforms (Telegram, Discord)
• Gaming data (Steam)
• Cryptocurrency wallets (applications and browser extensions)
• Local documents
• Desktop screenshots

Bypassing Chrome’s New Protections

One notable capability of SantaStealer is its attempt to bypass Chrome’s App‑Bound Encryption, a security feature introduced in July 2024 to combat info‑stealer malware.

The malware embeds a separate executable specifically designed to defeat this protection — a technique already observed in other active stealers like Vidar. This indicates that SantaStealer is following existing malware trends rather than introducing truly novel techniques.

Customization and Targeting

The affiliate panel allows operators to:

• Choose between full or selective data theft
• Exclude systems located in the Commonwealth of Independent States (CIS)
• Delay execution to reduce suspicion and evade sandbox analysis

These features are typical of modern MaaS offerings and aim to make the malware more flexible for attackers.

Distribution Still Unclear

Since SantaStealer has not yet been distributed at scale, its primary infection vector remains unknown. However, based on current cybercrime trends, likely delivery methods include:

• ClickFix attacks, where victims are tricked into pasting malicious commands into Windows terminals
• Phishing emails
• Pirated software and torrent downloads
• Malvertising campaigns
• Deceptive YouTube comments and fake tutorials

Final Thoughts

While SantaStealer is being marketed aggressively as a next‑generation info‑stealer, current evidence suggests it is still immature and far from the stealthy threat it claims to be. That said, its active development and commercial intent mean it could evolve quickly.

Rapid7 advises users to remain cautious:

• Avoid clicking unknown email links or attachments
• Do not run unverified scripts or extensions from public repositories
• Be especially wary of instructions that ask you to manually paste commands into your system

As always, early visibility into emerging malware families like SantaStealer gives defenders an advantage — before such threats mature and spread widely.