Santastealer

SantaStealer is a modular malware-as-a-service information stealer operated by Russian-speaking cybercriminals and assessed as a rebrand of Blueline Stealer. It is marketed on Telegram and Russian-language underground forums and has been linked to operators using the aliases Cracked and Furix. The operation appears financially motivated and includes configuration intended to avoid infecting Russian-speaking victims, a pattern commonly associated with Russian-speaking cybercrime ecosystems. SantaStealer is designed to steal credentials, cryptocurrency wallet data, and sensitive documents from a broad range of applications. Reported samples use multiple collection modules and execute key components in memory, including a browser decryption component, to reduce reliance on dropped files and improve evasion against file-based detection. Observed builds also compress stolen data and exfiltrate it in chunks. Despite marketing claims of strong stealth, analyzed samples have been described as relatively unsophisticated, with limited anti-analysis and anti-virtualization measures, unobfuscated code, and unencrypted strings. The actor’s known capabilities center on credential theft, cryptocurrency theft, data exfiltration, and initial access enablement for downstream criminal activity. As with other infostealer operations, stolen data could support follow-on intrusion activity by other financially motivated actors, including ransomware affiliates, although SantaStealer itself is primarily an infostealer rather than a ransomware operation.