Needle Stealer

The downloaded archive contains files set up for a technique known as DLL hijacking, where malware disguises itself as a legitimate library file that a trusted Windows program is expected to load automatically.

It also installs malicious browser extensions that give attackers ongoing control over the victim’s browser long after the initial infection... A separate extension module installs a malicious browser add-on that connects to a remote server, tracks the infected user with a unique ID, intercepts web traffic, and can even replace legitimate file downloads with malicious ones.

When a search engine or security scanner visits the page, the site redirects to an unrelated and harmless website. Only specific visitors, likely those fitting the profile of a real target, are shown the malicious content.

The first-stage executable runs, loads a second-stage DLL, and that DLL uses a technique called process hollowing to inject Needle Stealer directly into the RegAsm.exe process.

Attackers set up a fake website promoting something called TradingClaw, which they describe as an AI-powered trading assistant... By wrapping a dangerous payload inside what looks like a legitimate tool, the attackers are exploiting both financial curiosity and the growing hype around AI-powered trading applications.

The first-stage executable runs, loads a second-stage DLL, and that DLL uses a technique called process hollowing to inject Needle Stealer directly into the RegAsm.exe process.

When a search engine or security scanner visits the page, the site redirects to an unrelated and harmless website. Only specific visitors, likely those fitting the profile of a real target, are shown the malicious content.

In this particular campaign, the trusted Windows process being abused is RegAsm.exe, a legitimate .NET component used for registering assemblies.

The downloaded archive contains files set up for a technique known as DLL hijacking, where malware disguises itself as a legitimate library file that a trusted Windows program is expected to load automatically.

Needle Stealer is built to pull browser cookies, saved passwords, login sessions, and cryptocurrency wallet credentials off infected machines.

Needle Stealer is built to pull browser cookies, saved passwords, login sessions, and cryptocurrency wallet credentials off infected machines.

Its core module can capture screenshots, steal browser data, extract data from apps like Telegram and FTP clients, and collect text files and wallet data.

Its core module can capture screenshots, steal browser data, extract data from apps like Telegram and FTP clients, and collect text files and wallet data.

A separate extension module installs a malicious browser add-on that connects to a remote server, tracks the infected user with a unique ID, intercepts web traffic, and can even replace legitimate file downloads with malicious ones.

When a search engine or security scanner visits the page, the site redirects to an unrelated and harmless website. Only specific visitors, likely those fitting the profile of a real target, are shown the malicious content.