A newly discovered .NET-based infostealer dubbed “Chihuahua Stealer” has emerged as a significant threat, exploiting Google Drive documents to deliver malicious PowerShell scripts and steal sensitive data. Organizations are advised to restrict PowerShell execution policies and monitor for marker files (.normaldaki). G DATA’s detection rules, including PowerShell.Trojan-Downloader.Agent.IE1KHF and Win32.Trojan-Stealer.Chihuahua.8W7FOE, provide coverage against known variants. Once executed, the script establishes persistence via scheduled tasks, dynamically retrieves payloads from multiple command-and-control (C2) servers, and exfiltrates encrypted data over HTTPS. The attack chain begins with a heavily obfuscated PowerShell script embedded in a Google Drive document. The campaign gained attention after a Reddit user reported being tricked into executing a suspicious script linked to a Google Drive file, which initiated the stealthy payload delivery. The infection begins when victims open a Google Drive document containing an obfuscated PowerShell script. G DATA researchers noted that the malware’s use of Windows Cryptography API: Next Generation (CNG) for AES-GCM encryption and marker-based payload activation reflects a deliberate focus on avoiding detection. This script establishes persistence by creating a scheduled task named “f90g30g82” that runs every minute. First identified by G DATA analysts in April 2025, the malware targets browser credentials, cookies, and cryptocurrency wallet extensions through a multi-stage attack chain. This assembly, Chihuahua Stealer, exfiltrates stolen data as an AES-GCM-encrypted “.chihuahua” archive. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. When executed, the script bypasses execution policies and decodes a Base64 payload, which reconstructs a second-stage hex-encoded script. G DATA’s report emphasizes the importance of monitoring PowerShell logs for irregular scheduled tasks and in-memory .NET assembly loading. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 15 May 2025 13:34:52 +0000