Loading story…
A new Stealit malware campaign has been identified by Fortinet’s FortiGuard Labs, targeting Microsoft Windows users through the abuse of Node.js’ Single Executable Application (SEA) feature. The campaign marks a shift from previous Stealit operations, which relied on the Electron framework to package and distribute malicious payloads. By utilizing the SEA feature, attackers can bundle all necessary scripts and assets into a single executable, allowing the malware to run on systems without a pre-installed Node.js runtime or additional dependencies. This approach increases the likelihood of successful infections, as it reduces the technical barriers for execution on victim machines. The malware is primarily distributed via fake installers for popular games and VPN applications, which are uploaded to widely used file-sharing platforms such as Mediafire and Discord. These installers are often disguised using PyInstaller and compressed archives to further evade detection. Once executed, the malware performs several anti-analysis checks, including detecting debuggers, virtual environments, and suspicious processes, terminating itself if such conditions are found. A notable technical detail is the writing of a Base64-encoded, 12-character authentication key to the %temp%\cache.json file, which is used for communication with the command-and-control (C2) server. The Stealit operation is run as a malware-as-a-service (MaaS), offering various subscription plans for its data extraction tools, including a remote access trojan (RAT) with capabilities such as file extraction, webcam control, live screen monitoring, and ransomware deployment. The service targets both Windows and Android platforms, with pricing tiers ranging from weekly to lifetime licenses. The operators have demonstrated operational security by frequently relocating their C2 infrastructure, moving from domains like stealituptaded.lol to iloveanimals.shop. The campaign’s impact is significant, as compromised machines fall under the control of the threat actors, who can exfiltrate sensitive information for use in further attacks. The campaign’s use of advanced obfuscation and anti-analysis techniques makes detection and mitigation more challenging for defenders. Organizations are advised to be vigilant against suspicious installers, especially those distributed via unofficial channels, and to monitor for indicators of compromise associated with Stealit. The campaign underscores the evolving tactics of cybercriminals in leveraging new software features and distribution methods to maximize reach and evade security controls. Security teams should update their detection mechanisms to account for Node.js SEA-based malware and educate users about the risks of downloading software from untrusted sources. The ongoing nature of the campaign and its professionalized service model highlight the persistent threat posed by MaaS operations in the current cyber threat landscape.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that newer Stealit variants had moved back to Electron-based packaging while encrypting embedded Node.js scripts with AES-256-GCM. Despite the packaging change, the newer samples retained behavior similar to the SEA-based variants.
Analysis showed the installer stored components in randomized AppData paths and attempted to add Microsoft Defender exclusions for those directories. Stealit was found to steal credentials and cryptocurrency wallet data, provide RAT-like features such as screen and webcam access and command execution, and potentially deploy ransomware.
The malware's command-and-control infrastructure moved from stealituptaded[.]lol to iloveanimals[.]shop, a site posing as a commercial service offering Stealit subscriptions and licenses. Campaign infrastructure also served Brotli-compressed components from root.iloveanimals[.]shop.
Fortinet said it began investigating the campaign after observing increased detections of a Visual Basic script that was later identified as a persistence component of Stealit infections. This investigation led to broader analysis of the malware's delivery and execution chain.
Researchers reported that the campaign used Node.js Single Executable Application functionality, and in some cases Electron, to bundle malicious JavaScript into standalone executables that run without Node.js installed. The malware used obfuscation and anti-analysis techniques to hinder detection.
A Stealit malware-as-a-service campaign distributed infostealer payloads through trojanized game cheats, cracked software, and VPN installers shared via platforms such as MediaFire and Discord. The lures delivered standalone malware binaries to Windows users.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcefeeds.fortinet.com
Open sourcehackread.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Multiple active malware campaigns are using **social engineering** and **trojanized content** to compromise Windows systems, with lures ranging from pirated software downloads to business and shipping documents. AhnLab reported a “proxyjacking” operation attributed to **Larva-25012** that distributes fake installers (notably a trojanized *Notepad++* package) via cracked-software sites; the `Setup.zip` bundle includes a legitimate `Setup.exe` plus a malicious sideloaded DLL (`TextShaping.dll`) that decrypts and installs **DPLoader** for persistent command retrieval and follow-on payload delivery. The malware also tampers with defenses by changing Microsoft Defender settings (e.g., exclusions, reduced notifications, and blocking sample submission) to reduce detection while monetizing victims’ bandwidth through installed **proxyware**. Separately, FortiGuard Labs described a Russia-focused, multi-stage intrusion chain that abuses trusted services (**GitHub** and **Dropbox**) for payload hosting and weaponizes **Defendnot** (a Windows Security Center trust-model research tool) to disable **Microsoft Defender** before deploying a ransomware payload. Fortinet also documented phishing campaigns using weaponized shipping-themed Word documents to deliver **Remcos RAT**, including fileless execution behavior and exploitation of `CVE-2017-11882` (Microsoft Equation Editor) via remotely fetched templates. These campaigns reinforce the operational risk from user-driven execution paths (pirated installers and document lures), “living off the land” techniques, and defense evasion through both policy tampering and security tooling abuse.
Jun 29, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026