TROX Stealer Extracts Stored Credit Cards and Browser Credentials in Data Theft Campaign

A recent malware campaign featuring the TROX Stealer has gained attention for its sophisticated exfiltration capabilities, targeting sensitive data such as stored credit cards, browser credentials, cryptocurrency wallets, and session files of services like Discord and Telegram.

Sublime’s Threat Research team highlighted TROX Stealer as a malware-as-a-service (MaaS) offering that exploits urgency to design and deploy scaleable attack chains.

First analyzed in December 2024, the infostealer has rapidly emerged as a potent threat to consumer systems rather than enterprise networks, leveraging technical precision and organized infrastructure.

Phishing Emails as Delivery Mechanism

TROX Stealer’s attack chain begins with phishing emails employing urgency-based themes to manipulate victims into downloading malicious files.

Subject lines such as “Urgent Notice: Legal Action Scheduled for Your Debt” and “Immediate Payment Required to Prevent Legal Action” are crafted to create panic.

These emails direct victims to domains like documents[.]debt-collection-experts[.]com, hosting an executable file disguised as debt collection documents.

The malware employs unique tokens to ensure files are downloaded only once, preventing redundant downloads that could raise suspicion or aid researchers.

Upon execution, the downloaded file initiates a multi-stage installation process involving Python scripting, Nuitka compilation, Node.js interpreters, and obfuscated WebAssembly (Wasm) binaries to evade detection and analysis.

The campaign’s infrastructure reveals meticulous planning. Domains such as debt-collection-experts[.]online were registered as early as April 2024, with routine updates to SSL certificates and hosting configurations preceding attack phases.

TROX’s distribution network also utilized Cloudflare services for protection and integration with TOR exit nodes for anonymity.

Notably, malware binaries and modules were hosted on public repositories like GitHub to discreetly facilitate distribution.

During the installation stage, the malware uses multiple layers of obfuscation, such as Zstd compression and dynamic temporary folder creation, to conceal its activities.

An embedded Node.js interpreter executes encoded JavaScript and WebAssembly code for further payload deployment.

Sublime’s researchers identified over 71 function types and 4,700 functions embedded in the Wasm binary, showcasing extensive junk code designed to impede reverse engineering.

Data Theft Capabilities

Once installed, TROX Stealer employs standard data extraction techniques, querying application databases to collect sensitive information.

These include credit card details stored in web browsers, cryptocurrency wallet credentials, and user data from Discord and Telegram.

Data is exfiltrated via channels like GoFile and Telegram APIs. The malware’s reliance on pre-existing stealing methods highlights the accessibility of such attack mechanisms in the cybercrime ecosystem, as documented SQL queries and APIs are repurposed for malicious intent.

Although TROX Stealer leverages advanced techniques for evasion, its core functionality data theft based on application database queries offers avenues for detection.

Sublime successfully prevented delivery of phishing emails through AI-powered filters targeting unusual sender domains, overly urgent subject lines, and suspicious file attachments, such as Python-generated PDFs.

Notable file hashes further aid identification of malware samples, including DebtCollectionCase#######.exe and node700.exe.

The TROX Stealer campaign illustrates the growing complexity of modern malware, combining urgency-based phishing attacks with multi-layered technical strategies to exfiltrate sensitive data.

While MaaS frameworks like TROX make advanced malware accessible to bad actors, robust detection mechanisms and proactive security practices can mitigate their impact.

Researchers and organizations must remain vigilant to evolving malware techniques while leveraging AI-driven solutions to detect and neutralize threats at the earliest stages.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates