A new variant of the Katz Stealer malware has emerged as a formidable threat in the cybercrime underground, leveraging advanced techniques to harvest credentials from major browsers such as Chrome, Edge, Brave, and Firefox.
Operating as a malware-as-a-service, Katz Stealer is engineered to exfiltrate sensitive data while evading detection through a multifaceted infection routine and anti-forensics measures.
Stealer Exploits Browser Encryption
Upon infection, typically initiated via phishing emails, malicious software bundles, or compromised downloads, the attack chain unfolds with the deployment of obfuscated JavaScript hidden in gzip archives.
This script triggers additional payloads via PowerShell, ultimately executing a heavily obfuscated .NET loader through in-memory reflection.
Notably, Katz Stealer uses process hollowing to inject itself into legitimate processes like MSBuild.exe, thereby camouflaging its presence within routine system activity.
According to Nextron Systems Report, a standout feature of Katz Stealer is its targeted exploitation of browser App-Bound Encryption.
By injecting a custom DLL into headless browser processes, the malware accesses local state files to extract master decryption keys.
This allows Katz Stealer to decrypt and exfiltrate saved passwords, cookies, and authentication tokens from Chromium-based browsers and their extensions.
Similar attacks are executed against Firefox by targeting a range of data files within user profiles, facilitating the theft of credentials, session cookies, and browsing history.
The malware’s reach extends beyond web browsers. It is programmed to steal credentials from email clients (Outlook, Foxmail, Windows Live Mail), gaming platforms (notably Steam), FTP and VPN clients, and a diverse range of communication and messaging apps including Discord, Telegram, Slack, Signal, and Microsoft Teams.
Intriguingly, it hijacks Electron-based applications such as Discord, modifying core application files (index.js in app.asar) to establish a persistent backdoor that remotely executes attacker-controlled JavaScript payloads.
Broad Application Targeting Raise Alarms
Katz Stealer is also engineered for cryptocurrency theft. It actively scans for popular wallet applications and browser extensions covering over 150 wallet extension IDs to locate and exfiltrate wallet files, private keys, and seed phrases.
The malware employs keyword and extension-matching to ensure comprehensive coverage, copying all relevant data for subsequent upload to attacker-controlled infrastructure.
Evasion and persistence mechanisms are robust. The stealer employs geofencing, terminating execution in Commonwealth of Independent States (CIS) to avoid attracting regional law enforcement scrutiny.
Advanced sandbox and VM detection checks, such as screen resolution analysis and system uptime heuristics, allow the malware to evade automated analysis environments.
Process hollowing, memory wiping, and user account control (UAC) bypasses leveraging legitimate Windows binaries such as cmstp.exe further enhance its stealth.
Data exfiltration is orchestrated through persistent C2 communication, with the malware maintaining a TCP connection to hardcoded IP addresses and domains.
Stolen data is compiled from across the system, including decrypted browser keys, wallet dumps, VPN and WiFi credentials, and system reconnaissance details, before being transmitted in bulk to the attacker.
Security researchers have provided comprehensive YARA and Sigma rules to assist in detecting Katz Stealer behavior.
Key detection opportunities include monitoring for unusual process creation (such as MSBuild.exe as a child of suspicious parent processes), abnormal file writes in user AppData directories, browser execution in headless mode, and outbound connections to known C2 infrastructure with unique User-Agent strings (notably containing “katz-ontop”).
The sophistication and breadth of Katz Stealer underscore the increasing risk posed by modular stealer malware targeting the modern digital ecosystem.
Organizations are urged to monitor for the indicators of compromise detailed below, and to leverage the latest detection rules in their endpoint and network defenses.
Indicators of Compromise (IOC)
| Indicator Type | Value | Description |
|---|---|---|
| C2 IP | 185.107.74[.]40 | Primary command and control address |
| C2 IP | 31.177.109[.]39 | Alternate C2 server |
| C2 Domain | twist2katz[.]com | C2 domain for backdoor communication |
| C2 Domain | pub-ce02802067934e0eb072f69bf6427bf6[.]r2[.]dev | Temporary payload hosting |
| Related Domains | katz-stealer[.]com, katzstealer[.]com | Associated with malware infrastructure |
| User-Agent | Mozilla/5.0 … Chrome/135.0.0.0 … katz-ontop | Unique traffic fingerprint |
| Filenames | \AppData\Local\Temp\katz_ontop.dll \AppData\Local\Temp\received_dll.dll \AppData\Roaming\decrypted_chrome_key.txt \AppData\Roaming\decrypted_brave_key.txt \AppData\Roaming\decrypted_edge_key.txt | Artifacts written by Katz Stealer |
| SHA-256 | 6dc8e99da68b703e86fa90a8794add87614f254f804a8d5d65927e0676107a9d (katz_ontop.dll) 15953e0191edaa246045dda0d7489b3832f27fdc3fcc5027f26b89692aefd6e1 (received_dll.dll) | Known malicious payloads |
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
