Stealit Malware Exploits Node.js SEA Feature to Deliver Data-Stealing Campaigns

Summary

The Stealit malware campaign has evolved dramatically, using Node.js’s experimental Single Executable Application (SEA) feature to deploy its payload as self-contained, disguised installers for games and VPNs. These executables do not require Node.js preinstallation, making them more accessible for attackers and harder for defenders to detect.

Distributed via Discord, MediaFire, and file-sharing sites, the malware is packaged within PyInstaller bundles or compressed archives, masquerading as legitimate software. Operators now market Stealit as a commercial “data extraction” service, offering subscription plans, tutorials, and Telegram-based support.

The malware’s design enables it to steal browser credentials, cryptocurrency wallets, and system data, demonstrating the increasing sophistication of threat actors using modern developer tools like Node.js and Electron to craft stealthier, modular cyberattacks.

Attack Details

The Stealit campaign leverages Node.js SEA executables to deliver malicious payloads as standalone programs disguised as popular applications. Unlike traditional JavaScript malware, SEA binaries embed scripts directly in the executable, allowing them to bypass runtime dependencies and operate independently.

Key technical insights include:

1. Self-contained execution: Attackers embed malicious scripts as a NODE_SEA_BLOB, unpacking obfuscated code into memory and executing it via Node’s module loader.
2. Persistence and obfuscation: Execution follows a multi-stage chain, starting with a loader that triggers heavily obfuscated scripts responsible for installing malware components.
3. Evasion mechanisms: The malware performs environmental checks—CPU count, memory size, usernames, and hostnames—to evade sandboxes or virtual environments. It exits immediately if analysis tools or indicators of lab setups are detected.
4. System manipulation: When active, Stealit writes base64 tokens to temporary files, downloads components from command-and-control servers, and uses PowerShell to add infected directories to Windows Defender exclusion lists.
5. Component variety:
   • One module extracts browser data and system credentials.
   • Another targets gaming and cryptocurrency platforms, killing processes that may interfere.
   • The main component maintains remote access, reports victim details, and executes commands from attackers.
6. Infrastructure evolution: The group has migrated its control panel from stealituptaded[.]lol to iloveanimals[.]shop, and now sells its malware through a subscription-based “RAT-as-a-Service” model targeting both Windows and Android platforms.

Overall, the Stealit operators are refining commercialized malware ecosystems, merging offensive development practices with legitimate developer frameworks like Node.js SEA and Electron to improve both distribution efficiency and stealth.

Recommendations

• Download Software Only from Trusted Sources: Avoid downloading installers or archives from Discord, MediaFire, or unverified sources. Use official developer websites or authenticated app stores.
• Inspect and Restrict Executables: Block suspicious ZIP/RAR archives containing .exe or .vbs files. Verify authenticity with internal IT teams before execution.
• Limit Administrative Privileges: Enforce least privilege principles to restrict software installation and prevent unauthorized persistence mechanisms.
• Hunt for Suspicious Startup Entries: Regularly inspect Windows Startup folders and scheduled tasks for unknown executables or scripts (e.g., game_cache.exe, .vbs, .lnk).
• Enhance Endpoint Defense: Use Next-Generation Antivirus (NGAV) and EDR platforms capable of detecting obfuscation, process injection, and PowerShell-based exclusions. Employ machine learning and behavioral analytics for anomaly detection.

Indicators of Compromise (IoCs)

SHA256 Hashes:

• 554b318790ad91e330dced927c92974d6c77364ceddfb8c2a2c830d8b58e203c
• aa8f0988f1416f6e449b036d5bd1624b793b71d62889afdc4983ee21a1e7ca87
• 5ea27a10c63d0bbd04dbea5ec08fe0524e794c74d89f92ac6694cfd8df786b1f
• 083c4e0ffdc9edf0d93655ee4d665c838d2a5431b8064242d93a545bd9ad761b
• 432b8414113a8c14c0305a562a93ed926e77de351bac235552a59cc02e1e5627
• 8e1cf254d23e2b94c77294079336339ececf33a3e7ee1a3621ee4e0df0695ce5
• 919a2107ac27e49cdaa60610706e05edfc99bd3f2e9ca75da4feb6a5f2517c27
• e004f8e39e489dec74a13d99836ee5693bd509047ecf49f3fc14efc143a161b5
• 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
• 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
• 24b3def3f374c5f17ec9f1a347c71d9c921155c878ab36e48dd096da418bf782
• c38130d7cb43cf3da4858247a751d7b9a3804183db8c4c571b6eede0590474da

URLs:

• hxxps[:]//iloveanimals[.]shop/
• hxxps[:]//iloveanimals[.]shop/user/login
• hxxps[:]//root[.]iloveanimals[.]shop/download/save_data
• hxxps[:]//root[.]iloveanimals[.]shop/download/stats_db
• hxxps[:]//root[.]iloveanimals[.]shop/download/game_cache
• hxxps[:]//root[.]iloveanimals[.]shop/panelping
• hxxps[:]//root[.]stealituptaded[.]lol/download/save_data
• hxxps[:]//root[.]stealituptaded[.]lol/download/stats_db
• hxxps[:]//root[.]stealituptaded[.]lol/download/game_cache
• hxxps[:]//cdn[.]discordapp[.]com/attachments/…/VrchatPlugin.rar
• hxxps[:]//www[.]mediafire[.]com/file/…/ShaderSetup.rar/file

• hxxps[:]//download1529[.]mediafire[.]com/…/Aykadia.rar

MITRE ATT&CK TTPs

References

• Fortinet – Stealit Campaign Abuses Node.js Single Executable Application