Bandit Stealer Harvests Browser, Wallet, and Messaging Data on Windows

Researchers detailed Bandit Stealer, a Go-based information stealer for Windows that collects browser credentials, cookies, history, credit card data, cryptocurrency wallet contents, Telegram sessions, FTP and email client logins, keystrokes, clipboard data, and host profiling information. The malware attempts privilege escalation with runas.exe, establishes persistence through the Windows Run registry key, and stores stolen data in %appdata%\local subfolders named with the victim’s country code and IP address before archiving and exfiltrating the loot through the Telegram Bot API.

Bandit Stealer also uses extensive anti-analysis and sandbox-evasion checks to avoid detection, inspecting virtualization and security processes, debugger presence, blacklisted IP addresses, MAC addresses, hardware IDs, usernames, and computer names, and terminating when it detects likely research environments. Researchers said the malware has been delivered through self-extracting archive droppers disguised as benign documents or installers, including decoy Word, OpenVPN-related, and fake Heartsender files, while embedded Linux paths and commands suggest the codebase may still be evolving or could expand beyond Windows.