A New Infostealer Making Rounds Before the Holidays

Overview

Security researchers have encountered a new information stealer called SantaStealer propagating through Telegram channels. The malware first caught attention in early December when analysts came across a Windows executable that triggered infostealer detection rules during routine monitoring.

It appears to be a version of BluelineStealer, a malware that has been active since mid-2025. The threat actors seem to have given their project a seasonal makeover, complete with holiday themed branding and a fresh marketing push timed for the end of the year.

What the Malware Does

The core functionality of SantaStealer is designed to harvest sensitive information from infected Windows machines. The threat actors are selling it as a service, with price range of $175 to $300 per month depending on the individual requirements.

The malware targets a broad range of data:

• Saved passwords, cookies, and credit card details from web browsers

• Cryptocurrency wallet files and related browser extensions

• Session data from messaging apps like Telegram and Discord

• Gaming credentials, particularly Steam accounts

• Screenshots and sensitive documents stored locally

The threat actors were able breakthrough and able to achieve non-declinational persistency. The malware operate entirely in memory rather than writing files to disk, which makes it harder for traditional antivirus solutions to detect. For data harvesting, it compresses everything into chunks of about 10 MB and sends them out over plain HTTP.

Feature	Details
Target Systems	Windows 7 through Windows 11
Subscription Cost	$175/month (Basic), $300/month (Premium)
Data Exfiltration	HTTP on port 6767, 10 MB chunks
Primary Vector	Social engineering campaigns

How Infections Happen

The ClickFix Trick

Most attacks traced back to SantaStealer involve what researchers call ClickFix campaigns. These are social engineering attacks where victims are redirected on a fake webpage that asks them to complete some kind of verification step.

The shift is that these pages misguide the users to copy a command and paste it into PowerShell or the Windows command prompt. Users do this thinking they are verifying their identity or fixing an error, but what they are actually doing is downloading and executing the malware. No exploit required—just a convincing enough pretext to get someone to run a command.

Common themes include fake CAPTCHA challenges, browser update prompts, and technical support scams that claim something is wrong with the user's system.

Exploiting WinRAR

The threat actor also have access to an exploit for CVE-2025-8088, a vulnerability in WinRAR that was patched earlier this year. This bug allows attackers to craft malicious archive files that, when extracted, drop payloads into the Windows Startup folder. Once the victim reboots, the malware runs automatically.

The exploit takes advantage of how WinRAR handles certain path sequences, specifically using NTFS Alternate Data Streams to sneak files into locations they should not be able to reach.

CVE	Severity	Affected Versions	Fix
CVE-2025-8088	High (8.4)	WinRAR before 7.13	Update to 7.13+

Under the Hood

The developers had not stripped debug symbols from the binary, leaving behind over 500 function names that made reverse engineering significantly easier. Names like payload_main, check_antivm, and send_upload_chunk provided a roadmap of what the malware was doing.

The code includes three third-party libraries compiled directly into the executable:

• cJSON for parsing configuration data

• miniz for compressing stolen files

• sqlite3 for reading browser databases

Configuration data sits in the binary as plain JSON, complete with a text banner spelling out the malware's name and links to the Telegram channel. Not exactly subtle.

The 14 Collection Modules

SantaStealer uses a modular design with 14 separate components, each responsible for grabbing a specific type of data. These modules run in parallel threads, which helps the malware complete its collection phase in around 45 seconds.

Module	What It Grabs
Environment	System information and environment variables
Screenshot	Desktop capture
Documents	Files matching sensitive keywords
Telegram	Session files and configuration
Discord	Authentication tokens
Steam	Account credentials
Extensions	Browser extensions, especially crypto wallets
History	Browsing history
Passwords	Saved login credentials
Cookies	Session cookies for account hijacking
Credit Cards	Stored payment information
Autofill	Form data
Wallets	Cryptocurrency wallet files
Clipper	Clipboard monitoring for crypto addresses

Getting Around Chrome's Protections

In July 2024, Google introduced App-Bound Encryption in Chrome version 127. The idea was to tie the decryption of saved passwords and cookies to Chrome's own process, making it much harder for external programs to steal this data.

SantaStealer gets around this using a technique based on the publicly available ChromElevator project. The approach works like this:

• An encrypted DLL is embedded inside the main payload

• Two rounds of ChaCha20 decryption unpack it

• The decrypted code uses reflective process hollowing to inject into Chrome

• Running inside Chrome's context, it can decrypt the protected data

This works against all Chromium-based browsers, not just Chrome. Edge, Brave, Opera, and Vivaldi are all fair game.

Other infostealers have their own methods for dealing with App-Bound Encryption. Lumma abuses COM interfaces, Vidar uses memory dumping, and Stealc walks memory offsets. The ChromElevator approach is more reliable since it does not depend on specific Chrome version offsets.

Evasion Techniques

The malware includes a checks designed to detect analysis environments, though the implementation varies between samples.

Regional Targeting

Before doing anything else, the malware calls GetKeyboardLayoutList to check what keyboard layouts are installed. If it finds a Russian layout, execution stops. This is a common pattern among malware developed in the CIS region—operators do not want to target their own backyard.

Sandbox Detection

The check_antivm function runs through a series of tests:

• Checking for blacklisted process names using checksums

• Looking at the computer name for suspicious patterns

• Querying for VirtualBox guest services

• Measuring time intervals to detect debugger stepping

None of these techniques are particularly sophisticated. Analysts noted that different samples have different subsets of these checks, suggesting the codebase is still being actively developed.

Data Exfiltration

Once the data is collected, the malware compresses everything into a ZIP file saved to the Windows temp folder as Log.zip. After a time interval delay, a separate thread starts uploading the data.

The exfiltration uses plain HTTP on port 6767. The upload function breaks the zip into 10 MB pieces and sends each one as a multipart form POST request. Headers include an authentication token tied to the specific build and a campaign identifier.

Parameter	Value
Protocol	HTTP (unencrypted)
Port	6767
Endpoint	/upload
User-Agent	upload
Chunk Size	10 MB

Using unencrypted HTTP in 2025 is an unusual choice. It makes network-based detection straightforward and exposes the stolen data to anyone monitoring the traffic.

Network Indicators

Security teams should watch for connections to these addresses:

31[.]57[.]38[.]244:6767

80[.]76[.]49[.]114:6767

Both servers sit in AS 399486. Traffic will be HTTP POST requests to /upload with a User-Agent string of just upload.

File Indicators

A selection of hashes for known samples:

DLL Samples:

1a277cba1676478bf3d47bec97edaa14f83f50bdd11e2a15d9e0936ed243fd64

abbb76a7000de1df7f95eef806356030b6a8576526e0e938e36f71b238580704

5db376a328476e670aeefb93af8969206ca6ba8cf0877fd99319fa5d5db175ca

a8daf444c78f17b4a8e42896d6cb085e4faad12d1c1ae7d0e79757e6772bddb9

EXE Samples:

926a6a4ba8402c3dd9c33ceff50ac957910775b2969505d36ee1a6db7a9e9c87

9b017fb1446cdc76f040406803e639b97658b987601970125826960e94e9a1a6

MITRE ATT&CK Mapping