First observed in late January 2025, this malware harvests extensive personal and financial information from infected systems, including machine data, installed software, user credentials, cryptocurrency wallets, and browser data. The malware employs a methodical approach to data theft, systematically extracting information from various applications before compressing it and exfiltrating it to command and control (C2) servers. After successful data collection, SvcStealer can potentially download additional malware payloads, expanding its threat capabilities beyond initial data theft. A sophisticated new information stealer dubbed SvcStealer 2025 has emerged, targeting sensitive user data through spear phishing email attachments. After collecting sensitive information, the malware stores data in the ProgramData directory under the uniquely generated folder name. Using HTTP POST requests with a Content-Type of “multipart/form-data,” the malware transmits the stolen data disguised as normal web traffic. SEQRITE researchers identified this threat during routine threat hunting operations, noting that the malware is written in Microsoft Visual C++ programming language. Analysis revealed that SvcStealer implements evasive techniques by terminating monitoring processes and deleting traces of its activities to avoid detection by security tools. It targets specific applications including cryptocurrency wallets from multiple browsers (Chrome, Edge, Brave), messaging platforms (Telegram, Discord), and captures credentials from various browsers. The malware also takes screenshots and collects system information including running processes. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Upon infection, the malware generates a unique 11-byte alphanumeric value derived from the victim’s volume serial number through arithmetic operations. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 24 Mar 2025 06:40:04 +0000