SantaStealer Infostealer Rebrands and Targets Cryptocurrency Assets

Security researchers at Rapid7 have identified the re-emergence of SantaStealer, a malware-as-a-service infostealer that is being actively promoted on Telegram and hacker forums. SantaStealer is a rebranded version of the earlier BluelineStealer malware and is marketed as an in-memory malware designed to evade file-based detection. Despite claims of advanced stealth, analysis revealed that the malware is not particularly sophisticated, with leaked samples being easy to analyze and showing weak operational security.

SantaStealer features 14 modular components capable of stealing browser data, credentials, cryptocurrency wallets, messaging app data, documents, and screenshots. The stolen data is archived in memory before being exfiltrated. The malware is offered via subscription, with prices set at $175 per month for basic access and $300 for premium. This resurgence highlights ongoing threats to digital asset security, particularly as infostealer malware continues to evolve and target cryptocurrency users and platforms.