Loading story…
A new information stealer known as SantaStealer has surfaced, posing a significant threat to Windows users by exfiltrating sensitive documents, credentials, and cryptocurrency wallet data. Marketed aggressively on Telegram and underground forums, SantaStealer is a rebranded version of BluelineStealer and is being offered as a malware-as-a-service (MaaS) platform with customizable modules. The malware operates entirely in memory to evade traditional detection, compresses stolen data into 10 MB chunks, and transmits it to command-and-control servers via unencrypted HTTP. Rapid7 researchers have analyzed samples of SantaStealer, revealing that despite claims of advanced anti-detection features, the malware contains operational security weaknesses, such as unstripped symbols and unencrypted strings, making it easier to analyze.
SantaStealer's web panel allows threat actors to tailor the malware's configuration, including the ability to activate or deactivate up to 14 modules, integrate Telegram bot tokens for data exfiltration, and deploy fake error pages to distract victims. The MaaS is offered in basic and premium plans, with the latter including additional features like a crypto clipper and a polymorphic C engine. While the developers claim the malware is fully undetectable, security researchers have found it to be "ambitious but amateurish," with its final capabilities still under development. The emergence of SantaStealer highlights the ongoing evolution of the cybercrime ecosystem and the increasing sophistication of tools available to threat actors targeting sensitive user information.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Following the technical analysis, researchers published indicators of compromise and advised defenders to watch for suspicious links, attachments, downloads, and social-engineering lures that could deliver the infostealer. Reporting noted that the malware's simplicity reduced its sophistication but still left it dangerous for credential and wallet theft.
Rapid7 disclosed that SantaStealer includes 14 modules targeting browsers, messaging apps, cryptocurrency wallets, documents, and other applications, with in-memory loading, a web affiliate panel, and data exfiltration over unencrypted HTTP. The researchers also found its claims of being fully undetected were overstated because samples contained unobfuscated code, unencrypted strings, and weak operational security.
Rapid7 researchers examined SantaStealer samples, attributed the operation to Russian-speaking actors associated with the handles "Cracked" and "Furix," and found the malware avoids infecting systems with Russian keyboard settings. Their analysis concluded the malware was still under active development rather than a mature, widely deployed threat.
SantaStealer emerged on Telegram and Russian-speaking cybercrime forums as a malware-as-a-service offering and was identified as a rebrand of the earlier BluelineStealer. The service was marketed with subscription pricing and a planned release before the end of 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcego.theregister.com
Open sourcetheregister.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourceesecurityplanet.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Rapid7 have identified the re-emergence of SantaStealer, a malware-as-a-service infostealer that is being actively promoted on Telegram and hacker forums. SantaStealer is a rebranded version of the earlier BluelineStealer malware and is marketed as an in-memory malware designed to evade file-based detection. Despite claims of advanced stealth, analysis revealed that the malware is not particularly sophisticated, with leaked samples being easy to analyze and showing weak operational security. SantaStealer features 14 modular components capable of stealing browser data, credentials, cryptocurrency wallets, messaging app data, documents, and screenshots. The stolen data is archived in memory before being exfiltrated. The malware is offered via subscription, with prices set at $175 per month for basic access and $300 for premium. This resurgence highlights ongoing threats to digital asset security, particularly as infostealer malware continues to evolve and target cryptocurrency users and platforms.
Jun 29, 2026
Cybercriminals are actively marketing new information-stealing malware-as-a-service (MaaS) offerings on underground forums, with a focus on targeting credentials, browser data, and cryptocurrency wallets. The "MioLab MacOS" infostealer is being promoted as a resident macOS malware with a web-based control panel, customizable settings, and support for stealing data from over 200 crypto wallet extensions and more than 15 password managers, including Apple Keychain and LastPass. The malware is sold via a subscription model, with additional modules for hardware wallets like Ledger and Trezor, and is designed to appeal to cybercriminals seeking to compromise Apple devices and digital assets. Separately, "SantaStealer" is a new infostealer being advertised on Telegram and hacker forums, operating as a rebranded version of BluelineStealer. It is promoted for its in-memory operation to evade detection, though researchers note its current samples are not as stealthy as claimed. SantaStealer features a user-friendly affiliate panel, multiple data-theft modules, and flexible configuration options, allowing attackers to tailor payloads for specific data theft objectives. Both malware families exemplify the growing sophistication and commercialization of MaaS operations, lowering the barrier for cybercriminals to launch targeted credential and asset theft campaigns.
Jun 29, 2026
**Stealc**, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures. Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.
Sep 9, 2026