Deep#Door is more than a simple password stealer. The campaign combines an obfuscated batch loader, embedded Python payloads, multi-layer persistence, and defense evasion to create a long-lived Windows backdoor that can steal browser passwords, cloud tokens, SSH keys, Wi-Fi credentials, and more.
The infection starts with a batch file named install_obf.bat, which reads its own contents, extracts the embedded Python implant, and writes it to disk as svc.py under a fake service-like folder.
Securonix says this self-contained design removes the need for a separate payload download and reduces the network activity defenders usually rely on for detection.
Deep#Door Stealer Campaign
Before the malware fully activates, it tries to weaken the host.
According to Securonix, Deep#Door disables or tampers with Microsoft Defender features, PowerShell logging, firewall logging, AMSI, ETW, and event logs, while also using sandbox checks, debugger detection, and virtual machine detection to avoid analysis environments.
.webp)
The malware also reinforces its own survival.
It creates multiple persistence points, including the Startup folder, registry Run keys, scheduled tasks, and optional WMI subscriptions, then adds a watchdog routine that can recreate missing artifacts if defenders delete them.
.webp)
What It Steals
Once established, Deep#Door acts like a full remote access trojan.
It supports keylogging, clipboard monitoring, screenshot capture, webcam access, microphone recording, remote command execution, and system reconnaissance, giving attackers a broad view of the victim machine.
Its credential theft is especially dangerous because it reaches beyond browsers.
The malware targets stored passwords in Chrome and Firefox, SSH private keys, Windows Credential Manager entries, and cloud credentials for services such as AWS, Azure, and Google Cloud.
.webp)
A practical risk is that one infected laptop can expose both personal and corporate access. For example, a browser password, an SSH key used for admin access, and a cloud token for infrastructure management could all be stolen from the same host.
Deep#Door uses bore[.]pub as part of its command-and-control setup, which makes the traffic look less like a classic attacker-owned server and more like a tunneling service in normal use.
That approach can make infrastructure-based blocking and attribution more difficult for defenders.
Researchers said the implant uses encoded configuration values, dynamic port generation, and challenge-response authentication to find and use the tunnel.
It also retries connections and can scan a wide range of ports until it finds an active endpoint, which helps it stay operational even when conditions change.
Defenders should treat unexplained batch-script execution, suspicious PowerShell tampering, and outbound tunnel-like connections as warning signs.
Securonix recommends checking persistence locations, reviewing memory for patched system libraries, and looking for signs of credential-access behavior on affected endpoints.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
