Myth Stealer

Its remote-control features include running commands, downloading or deleting files, [and] managing processes.

The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain.

HKCU\...\Policies\System\DisableTaskMgr disables Windows Task Manager; cursor and colour-filtering registry paths are used for cursor replacement and screen-colour inversion.

Its remote-control features include ... setting itself to start again after a reboot.

Its remote-control features include ... setting itself to start again after a reboot.

Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt. Accepting it can give the malware greater access.

The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.

The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings. The stage-two container is named DiscordNitroGenerator.exe.

HKCU\...\Policies\System\DisableTaskMgr disables Windows Task Manager; cursor and colour-filtering registry paths are used for cursor replacement and screen-colour inversion.

Myth Stealer targets... active session cookies. Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session.

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames [and] passwords.

Its remote-control features include running commands, downloading or deleting files, managing processes...

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage. Myth Stealer also collects system details.

The malware also collects ... files.

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including ... browsing records and active session cookies.

hxxp[://]ip-api[.]com/json/?fields=query,countryCode Host geolocation lookup.

hxxp[://]ip-api[.]com/json/?fields=query,countryCode is identified as a host geolocation lookup URL.

The malware also collects system details, chat content, clipboard data and files.

The malware ... can capture screenshots or webcam material.

The malware also collects system details, chat content, clipboard data and files.

The malware ... can capture screenshots or webcam material. %TEMP%\webcam-<timestamp>.jpg is listed as webcam-capture output.

The operation used web-based reporting channels to receive stolen information. Listed infrastructure includes HTTP command, telemetry, upload, and Discord webhook endpoints.

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background... Dropbox [is the] second-stage download location.

The operation used web-based reporting channels to receive stolen information... Embedded exfiltration webhook URLs [are listed].

Researchers found functions that could ... attempt[] to restrict access to security tools. The DisableTaskMgr registry value disables Windows Task Manager.