MetaStealer

MetaStealer is an information-stealing malware family that emerged in 2022 and has been widely described as a derivative or variation of RedLine Stealer. It is primarily associated with Windows infections, where it has been observed as a commodity infostealer with broader remote-access and post-compromise functionality than simple credential theft alone. Separate reporting has also identified a distinct macOS infostealer family using the same name, targeting business users through malicious application bundles and social-engineering lures. Across both ecosystems, MetaStealer is used to harvest sensitive data from compromised hosts and exfiltrate it to attacker-controlled infrastructure.

On Windows, MetaStealer has been delivered through multiple initial-access vectors, including malspam with malicious Excel attachments requiring macro execution, phishing campaigns using OneNote payloads, fake software installers, and malvertising that impersonates legitimate software brands. Observed infection chains have used scripts and staged payload retrieval from public hosting services before establishing persistence and contacting command-and-control infrastructure. Persistence mechanisms reported for Windows variants include scheduled tasks and user logon shell modification. Defense-evasion behavior includes runtime string obfuscation and attempts to weaken Microsoft Defender protections by adding exclusions.

Windows MetaStealer is designed to steal browser data from Chromium-based browsers and Firefox, including cookies and saved passwords, and reporting also attributes theft of files and, in some cases, cryptocurrency-wallet-related data. Technical analyses have recovered references to browser storage artifacts and collection workflows consistent with credential and session theft. Some variants also support keylogging, arbitrary command execution, and hidden remote-control functionality, indicating use beyond pure smash-and-grab theft. Additional analyses describe command-and-control tasking, shellcode-related functionality, SOCKS or backconnect capability, and other post-exploitation features. MetaStealer has also been observed adapting to newer browser protections, including techniques associated with Chromium Application-Bound Encryption bypass via COM-based interaction with browser elevation services.

MetaStealer communications have been linked to structured HTTP-based tasking and collection endpoints, and multiple reports describe the family’s use of domain generation algorithms for command-and-control discovery. Researchers have documented both older pseudo-random domain generation and newer wordlist-based DGA behavior, with gate infrastructure appearing relatively domain-agnostic and relying on consistent ports, URIs, and headers. Obfuscation is a recurring trait in Windows samples, including XOR-based string decoding and encrypted configuration data.

The malware has been associated with criminal distribution as well as use in targeted phishing operations. Reporting has linked MetaStealer to campaigns run by Sticky Werewolf against Russian scientific, industrial, and government-related organizations, alongside other malware used by that actor. MetaStealer has also been cited among infostealer families whose stolen credentials were later abused in follow-on intrusions, including compromises of Snowflake customer environments.

A macOS malware family also tracked as MetaStealer appeared in 2023. That family is a Go-based infostealer distributed in malicious DMG and ZIP lures, often themed around business communications or fake clients. It targets Intel-based macOS systems and has been observed stealing keychain data, saved passwords, and files, with some variants also referencing Telegram and Meta-related data. Its delivery model differs from many macOS stealers by focusing on business-themed social engineering rather than primarily cracked-software lures.