LTX Stealer

LTX Stealer is a Windows information-stealing malware family, described by CYFIRMA as a new Node.js-based stealer and assessed as being offered as a Stealer-as-a-Service. It is distributed via a heavily obfuscated Inno Setup installer, including samples such as a file named "Negro.exe," which masquerades as a legitimate Windows application. The installer contains a very large encrypted archive, reported as over 375 MB, intended to overwhelm scanners and hinder static analysis. After execution, it drops an "updater.exe" payload into a hidden system directory; this payload is not a legitimate updater but a bundled Node.js runtime built with pkg, embedding malicious JavaScript and dependencies. The JavaScript is compiled to bytecode to complicate reverse engineering.

Its primary objective is data theft. LTX Stealer targets Chromium-based browsers, including Google Chrome and Microsoft Edge, and steals saved passwords, cookies, credentials, and active session tokens. CYFIRMA reported it uses a script named "decrypt.py" that follows Chromium decryption logic to bypass browser key protection. The malware also searches for cryptocurrency-related artifacts, including wallet-related files and browser extensions, with the apparent goal of stealing digital assets and draining cryptocurrency wallets.

The malware uses legitimate cloud services as part of its operator infrastructure. Reporting states it uses Supabase for backend functionality, including authentication and access control for an operator panel, while Cloudflare fronts backend services and helps mask infrastructure. CYFIRMA assessed that LTX Stealer abuses legitimate software frameworks and cloud services to maintain a low-noise profile and evade security controls.

Available reporting indicates LTX Stealer is marketed on criminal channels rather than being bespoke to a single intrusion. Evidence cited by CYFIRMA indicates Stealer-as-a-Service pricing tiers of USD 10 weekly and USD 25 monthly, suggesting low-cost, scalable distribution. High-confidence observed characteristics are: Windows targeting, Node.js runtime embedding, Inno Setup-based delivery, browser credential and session theft from Chromium-based browsers, cryptocurrency artifact targeting, and use of Supabase and Cloudflare in its backend infrastructure.