SantaStealer Malware-as-a-Service Emerges Targeting Windows Users

A new information stealer known as SantaStealer has surfaced, posing a significant threat to Windows users by exfiltrating sensitive documents, credentials, and cryptocurrency wallet data. Marketed aggressively on Telegram and underground forums, SantaStealer is a rebranded version of BluelineStealer and is being offered as a malware-as-a-service (MaaS) platform with customizable modules. The malware operates entirely in memory to evade traditional detection, compresses stolen data into 10 MB chunks, and transmits it to command-and-control servers via unencrypted HTTP. Rapid7 researchers have analyzed samples of SantaStealer, revealing that despite claims of advanced anti-detection features, the malware contains operational security weaknesses, such as unstripped symbols and unencrypted strings, making it easier to analyze.

SantaStealer's web panel allows threat actors to tailor the malware's configuration, including the ability to activate or deactivate up to 14 modules, integrate Telegram bot tokens for data exfiltration, and deploy fake error pages to distract victims. The MaaS is offered in basic and premium plans, with the latter including additional features like a crypto clipper and a polymorphic C engine. While the developers claim the malware is fully undetectable, security researchers have found it to be "ambitious but amateurish," with its final capabilities still under development. The emergence of SantaStealer highlights the ongoing evolution of the cybercrime ecosystem and the increasing sophistication of tools available to threat actors targeting sensitive user information.