Stealit

Stealit is an information-stealing malware family and malware-as-a-service offering observed in campaigns distributing fake game and VPN installers via Mediafire and Discord. Fortinet FortiGuard Labs reported that the campaign abuses Node.js Single Executable Application (SEA) and, in some newer samples, Electron, to package heavily obfuscated malicious Node.js code into standalone binaries that can run without Node.js installed. The installer is described as a multi-layered SEA executable built with AngaBlue that decodes and executes multiple in-memory script layers and uses anti-analysis checks including VM, timing, process, registry, DLL, and parent-process checks.

The malware downloads Brotli-compressed components from root.iloveanimals[.]shop, stores them under randomized paths in %UserProfile%\AppData\Local{RandDir}*.exe, and attempts to exclude those directories from Microsoft Defender. Persistence is established via a startup.vbs script. If run with high privileges, it writes logs and stores a 12-character alphanumeric authentication key in %temp%\cache.json; this key is used for C2 authentication and is also described as the same key used by subscribers to access their dashboards.

Reported components include save_data.exe, which uses ChromElevator to extract data from Chromium browsers; stats_db.exe, which collects browser and application data; and game_cache.exe, which functions as the C2 client. Stealit is capable of stealing login credentials, cryptocurrency wallets, and other data from many applications. Its C2 receives the victim username, hardware ID, and authentication key, and can issue commands for live screen viewing, webcam viewing, file theft, remote command execution, and ransomware deployment. The associated infrastructure reportedly moved from stealituptaded[.]lol to iloveanimals[.]shop, which masquerades as a commercial "professional data extraction solutions" site advertising Stealit subscriptions and licenses for Windows and Android. A Telegram channel named StealitPublic and contact handle @deceptacle were identified in connection with promotion of the service.