Loading malware…
EDDIESTEALER is a novel Rust-based commodity infostealer targeting Windows systems. Elastic Security Labs reported it being distributed via fake CAPTCHA/ClickFix-style social-engineering pages hosted on compromised or adversary-controlled websites. In the observed infection chain, an obfuscated React-based page displays a fake verification prompt, copies a malicious PowerShell command to the victim’s clipboard, and instructs the user to execute it via Windows+R. That command downloads a second-stage JavaScript file, gverify.js, from llll[.]fit/version/, executes it with cscript in a hidden window, and the loader then retrieves the EDDIESTEALER executable from llll[.]fit/io, saving it under a pseudorandom 12-character filename in the Downloads folder.
The malware uses XOR-encrypted strings, custom WinAPI resolution, and a per-sample mutex based on a decrypted UUID, with one reported example being 431e2e0e-c87b-45ac-9fdb-26b7e24f0d39. It performs a basic sandbox check by verifying the host has more than roughly 4 GB of physical memory and can self-delete if the check fails. Self-deletion is implemented by renaming its NTFS $DATA stream to :metadata and setting delete-on-close via SetFileInformationByHandle.
EDDIESTEALER communicates with C2 over HTTP. Its initial request uses a URI pattern of <C2>/<resource_path>/<UUID>, with api/handler observed as the resource path. It retrieves a second-stage configuration via HTTP GET; the configuration is AES-CBC encrypted and Base64-encoded in the format Base64(IV):Base64(ciphertext). The analyzed sample stored the server-to-client AES key unencrypted in UTF-8 form in .rdata. Decrypted configuration data includes a session ID, a list of theft tasks, a client-to-server AES key, and a self-delete flag. Elastic also noted newer variants that hardcode both AES keys and appear to rely on server-side anti-analysis logic that may return empty task lists to suspected sandbox environments.
Its theft scope includes browser data, browser extension data, password managers, cryptocurrency wallets, FTP clients, and Telegram Desktop. Specifically reported targets include Microsoft Edge, Brave, Google Chrome, and Mozilla Firefox; password managers Bitwarden, 1Password, and KeePass; wallets such as Armory, Bitcoin, WalletWasabi, Daedalus Mainnet, Coinomi, Electrum, Exodus, DashCore, ElectronCash, Electrum-DASH, Guarda, and Atomic; FTP clients including FileZilla, FTP Manager Lite, FTPbox, FTP Commander Deluxe, Auto FTP Manager, 3D-FTP, FTPGetter, and Total Commander; and Telegram Desktop data under %appdata%\Telegram Desktop\tdata*. It reads targeted files using standard kernel32 APIs including CreateFileW, GetFileSizeEx, ReadFile, and CloseHandle.
A notable capability is its Chromium-focused credential theft. Elastic reported that EDDIESTEALER reimplements ChromeKatz-like logic in Rust to bypass Chromium application-bound encryption protections and recover sensitive browser data. It can spawn a hidden Chromium window using --window-position=-3000,-3000 or launch Chrome with --remote-debugging-port to access password-manager data and scrape plaintext credentials from process memory. Reporting also specifically noted its ability to bypass Chromium app-bound encryption to obtain unencrypted sensitive data such as cookies.
After receiving tasks, EDDIESTEALER profiles the victim by collecting the executable path, locale ID, username, physical memory size, and OS version; newer variants additionally collect running processes, GPU information, CPU core count, CPU name, and CPU vendor. It exfiltrates host information and stolen data through multiple task-specific HTTP POST requests rather than HTTPS. Decrypted Rust panic metadata exposed internal source paths including apps\bin\src\services\chromium_hound.rs and apps\bin\src\services\system.rs.
Elastic identified 15 additional related samples on VirusTotal and associated the malware with infrastructure including 45.144.53[.]145, 84.200.154[.]47, shiglimugli[.]xyz, xxxivi[.]com, llll[.]fit, plasetplastik[.]com, and militrex[.]wiki. High-confidence detection opportunities mentioned in the reporting include the fake CAPTCHA/clipboard PowerShell delivery chain, gverify.js, the api/handler/<UUID> C2 pattern, HTTP GET/POST tasking and exfiltration, XOR-obfuscated strings, and Chromium credential-theft behavior.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Fake CAPTCHAs are malicious constructs that replicate the appearance and functionality of legitimate CAPTCHA systems... They often appear as prompts like "Verify you are a human" or "I'm not a robot," blending seamlessly into compromised websites or phishing campaigns.
This command silently downloads a second-stage payload ( gverify.js ) from the attacker-controlled domain hxxps://llll.fit/version/ and saves it to the user’s Downloads folder.
The majority of strings that give away its malicious intent are encrypted... EDDIESTEALER encrypts most strings via a simple XOR cipher.
EDDIESTEALER utilizes a custom WinAPI lookup mechanism for most API calls... invokes a well-known implementation of GetProcAddress to retrieve the address of the exported function.
The second-stage configuration data is AES CBC encrypted and Base64 encoded... Following the same data format... initial host information is AES-encrypted
For this particular sample... exfiltration targets: ... Browsers ... Password managers ... In order to get all entries of Chrome’s Password Manager, EDDIESTEALER begins its credential theft routine...
After analysis, more recent samples were identified with additional capabilities. Information gathered on victim machines now include: Running processes
EDDIESTEALER performs system profiling to gather some information about the infected system: Location of the executable... Locale ID... Username... Total amount of physical memory... OS version... Newer variants also gather running processes, GPU information, CPU cores, CPU name, CPU vendor.
EDDIESTEALER then communicates with its C2 server by sending an HTTP GET request... initial host information is AES-encrypted... and sent via an HTTP POST request
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a comparison family that did not technically match the observed sample.
Rust-based infostealer delivered via ClickFix fake CAPTCHA pages; steals sensitive browser data and is noted for bypassing Chrome App-Bound Encryption.
An infostealer referenced as another malware family deployed via ClickFix social engineering.
EDDIESTEALER is a Rust-based information stealer that bypasses Chromium's app-bound encryption to steal browser data, including cookies, by leveraging open-source projects like ChromeKatz.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.