Threat Researcher at Gen

Our team invests countless hours in the exploration, discovery and investigation of emerging trends such as AI and futuristic technology. Stay informed about the evolving landscape of cyberthreats through our diligent efforts and insights.

Security Evangelist at Gen

Threat Operations Analyst at Gen

Research

A fake invoice in your email is easy to ignore. A fake invoice inside your order history feels different.&nbsp;Norton customers have reported fake Norton invoices appearing inside the Shop app, the shopping and order-tracking app from Shopify. Public reports suggest the same technique is not limited to Norton. Similar suspicious Shop app notifications have used McAfee, Apple gift cards, iPhones, PayPal-style payment claims and other high-value purchases as bait. The impersonated brand may change, but the mechanics are familiar: make the user believe they have been charged, then give them a phone number to call.&nbsp;That phone number is where the scam really begins.&nbsp;<h4>Why the Shop app makes this more believable&nbsp;</h4>Shop is a legitimate app. People use it to track packages, check receipts and receive order updates. According to Shop’s own documentation, the app can automatically track orders from several sources, including Gmail, Outlook, the email address linked to the user’s Shop account and orders paid through Shop Pay. If Gmail or Outlook is connected, Shop says it scans recent emails for keywords such as “tracking number” and “track your package” to populate deliveries in the Orders tab.&nbsp;

Shop also supports push notifications for delivery updates, payments and favorite products. So the first alert the victim sees may not be an email, an SMS or a calendar invite. It may be a notification from an app they already use for real purchases.&nbsp;That context matters. The scam text is not especially polished. Some of the examples we reviewed contain awkward wording and obvious signs of fraud. But when the message appears inside an order-tracking app, surrounded by real receipts and shipping updates, users may give it more credibility than it deserves.&nbsp;The screenshots reported to us show fake orders under generic seller names such as “My Store.” The receipts claim that a Norton or Norton LifeLock subscription has been activated or renewed, usually for several hundred dollars. The phone number appears in the product description, the receipt body or even the shipping address field.&nbsp;That is not how a normal receipt should look.&nbsp;<h4>The brand is interchangeable&nbsp;</h4>Norton is the example we saw through customer reports. Norton support now warns that scammers may abuse Android and iOS shopping platforms or applications to generate fake order notifications that appear to be legitimate Norton purchases. Those notifications may include fake order confirmations, fake charges, trusted third-party app delivery and fake support phone numbers embedded in order details.&nbsp;Public user reports point to a wider pattern. One Reddit user described receiving a Shop.app message about a transaction they did not recognize, with no follow-up email confirmation, and a message telling them to call support if the order was not placed by them. Another thread includes reports of unrecognized iPhone purchases under “My Store,” suspicious contact emails and users saying they saw no matching charges on their bank cards. Other reports mention fictitious Apple gift card purchases and iPhone orders using the same kind of wording: “If Order Not Placed By You,” followed by a phone number.&nbsp;The choice of brand is part of the social engineering. A fake security subscription charge plays on two fears at once: being billed for something you did not buy, and being left unprotected if you ignore it. Apple products and gift cards create high-value purchase panic. PayPal-style wording makes users worry about payment account abuse. In each case, the fake order is there to push the victim toward a call.&nbsp;<h4>What we know, and what we do not&nbsp;</h4>We have not found any evidence that any of the impersonated brands have been compromised.&nbsp;&nbsp;We also should not claim that Shop or Shopify was breached based on the evidence we have. The exact abuse path still needs confirmation. The fake order may be entering the app through a merchant/order workflow, through email parsing, through account association, or through another legitimate mechanism that scammers have found a way to misuse. Shop’s own documentation shows that orders can populate from multiple sources, so assuming one route would be premature.&nbsp;&nbsp;What we can say is narrower and stronger: scammers are placing fake purchase claims inside shopping app order experiences, where users are used to seeing real receipts and order updates. Norton’s own support page now describes this class of shopping app scam, and public reports show similar lures using other brands and products.&nbsp;&nbsp;That is enough to warn users without overstating the technical evidence.&nbsp;<h4>How the scam works&nbsp;</h4>The user receives a notification or sees a new order in the Shop app. The order looks like a receipt for something expensive: a security subscription, an Apple gift card, an iPhone, a MacBook or another high-value purchase.

The receipt says the charge has been processed, the subscription has renewed, or the order is being prepared. Somewhere in the order details, the scammer inserts a phone number, email address or support instruction.&nbsp;The wording is often clumsy. We have seen phrases like “If Order Not Place By You” and “If Need Help.” Those errors may look obvious when reviewing a screenshot. They are easier to miss when a phone notification tells you that hundreds of dollars have just been charged.&nbsp;If the victim calls, the scam moves off-platform. The person answering may claim to be billing support, Norton support, PayPal support or a cancellation department. The script can vary, but the request usually moves toward credentials, payment data, one-time codes or remote access software.&nbsp;By that point, the fake receipt has done its job. It has created enough urgency for the victim to enter a conversation controlled by the scammer.&nbsp;<h4>Why this is harder for users to judge&nbsp;</h4>Most people understand that email can be spam. They may still fall for phishing, but at least the inbox is a place where scams are expected.&nbsp;Order-tracking apps are different. Their purpose is to collect receipts, shipping updates and purchase information in one place. A notification from that environment can feel as if it has already passed through some layer of trust, even when the content inside the order is fraudulent.&nbsp;We have seen the same logic with calendar invite scams. The message itself is not always convincing, but the delivery channel changes how people read it. A fake invoice in an inbox is one thing. A fake invoice inside a calendar reminder or shopping app receipt can feel closer to a real event.&nbsp;For security products, this also creates a detection problem. The first visible alert may not be an email, SMS or malicious website. It may be a legitimate app notification carrying fraudulent text. The scam still depends on social engineering, but the delivery surface is harder to classify with the usual rules.&nbsp;<h4>What to do if you see one&nbsp;</h4>Do not call the number in the receipt.&nbsp;Check the charge directly. Open your bank or credit card app. Open the official account for the brand being impersonated. If it claims to be Norton, go to your Norton account or official Norton support. If it claims to involve PayPal, open PayPal directly. Do not use the phone number, email address or link inside the suspicious order.&nbsp;If there is no matching charge, treat the receipt as a scam attempt.&nbsp;Report the suspicious store or message in the Shop app if the option is available. Shop’s help pages say suspicious Shop stores can be reported from the store page through the app, and Shopify also tells users to forward phishing messages to its phishing inbox.&nbsp;&nbsp;Norton users can forward suspicious messages to Norton and should verify unexpected charges only through their Norton account or official Norton support channels.&nbsp;&nbsp;Opening the receipt does not automatically mean your device was compromised. The risk increases if you call the number, share information, install software or follow instructions from the person on the phone.&nbsp;<h4>What to do if you have already called&nbsp;</h4>End the call.&nbsp;If you shared payment details, contact your bank or card provider immediately using the number on your card or inside your banking app. If you gave away a password, change it from a different device if possible. Start with your email account, Apple ID or Google account, banking account and any account connected to the fake invoice.&nbsp;If you installed remote access software, disconnect the device from the internet and remove the software. Run a security scan before using the device again for banking, email or shopping.&nbsp;If you gave a one-time code to the caller, treat the related account as compromised. Change the password, review recovery options and check recent login activity.&nbsp;<h4>The lesson&nbsp;</h4>Scammers keep testing new places to put old tricks. For years, fake invoices were mostly an email problem. Then similar subscription notices appeared in calendar invites. Now we are seeing fake receipts inside shopping app order histories and push notification flows.&nbsp;The safest response is to separate the alert from the action. If an app, email, text message or calendar invite says you have been charged, do not use the contact details inside that alert. Go directly to the account or payment provider yourself. Check whether the charge exists. Use official support channels.&nbsp;The fake receipt, the fake support number and the fake emergency are all part of the same controlled environment. The moment you verify the charge somewhere else, the scam loses most of its power.&nbsp;

Scammers are using order-tracking apps to place fake receipts where users expect to see real purchases, then pushing them to call fake support numbers. 

Fake invoices are moving from inboxes to shopping apps 

<h2>Introduction&nbsp;</h2>Infostealers are constantly evolving, and so are the techniques they use to bypass <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">Application-Bound Encryption (ABE)</a>. In recent weeks, Vidar has been among the most actively developed stealers and, apart from <a href="https://x.com/GenThreatLabs/status/2064836539952361976" target="_blank" rel="noreferrer noopener">multiple updates to its string obfuscation</a> and <a href="https://x.com/GenThreatLabs/status/2061462524604649840" target="_blank" rel="noreferrer noopener">a reworked approach to protecting its configuration</a>, it has also introduced a novel technique for bypassing ABE. And while there have been many other changes in Vidar lately, with new versions dropping every week, in this blog post we focus solely on the ABE bypass and its technical aspects.&nbsp; &nbsp;<h2>The ABE Bypass&nbsp;</h2>From a high-level perspective, Vidar’s approach to bypassing ABE is somewhat similar to that of Remus/Lumma, in that both try to extract the <code>v20_master_key</code> directly from the browser’s memory. What sets them apart, however, is how they achieve it. Since we’ve already covered the inner workings of ABE in earlier posts (<a href="https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer" target="_blank" rel="noreferrer noopener">Remus</a>, <a href="https://www.gendigital.com/blog/insights/research/voidstealer-abe-bypass" target="_blank" rel="noreferrer noopener">VoidStealer</a>), we don’t revisit them here and focus instead on the bypass itself. For readers interested in the broader background, we encourage checking those earlier posts.&nbsp;&nbsp;In short, the end goal of infostealers is to obtain the <code>v20_master_key</code>, as it alone is sufficient for decrypting any ABE-protected data tied to a specific application. This key can be obtained in one of two ways: either from disk, where it is protected by two layers of <code>CryptProtectData</code> (one applied in the context of the logged-in user and one as <code>NT AUTHORITY\SYSTEM</code>), or from the browser’s memory – the direction Vidar took.&nbsp;In memory, however, the key is kept protected with <code>CryptProtectMemory</code> using the <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code> flag. This ensures that even if an attacker manages to read the encrypted form of the key from memory, they cannot simply decrypt it (they would need to invoke the complementary <code>CryptUnprotectMemory</code> function directly from within the browser process). That leaves attackers with two problems to solve: how to find the encrypted key in memory, and how to get it decrypted.&nbsp;<h2>Locating the v20_master_key in Browser’s Memory&nbsp;</h2>Vidar’s approach to locating the encrypted <code>v20_master_key</code> in memory involves scanning the entire memory of a running browser for a specific pattern. But that first requires a browser process to scan.&nbsp;When the target browser is already running, Vidar reuses the existing process. However, it doesn’t read its memory directly. Instead, it creates a fork of it using <code>NtCreateProcessEx</code> with <code>SectionHandle</code> set to <code>NULL</code>, instructing the kernel to clone the address space of the process specified by the <code>ParentProcess</code> as a copy-on-write mapping. The resulting process has no threads and is never resumed – it exists purely as a static memory snapshot.&nbsp;&nbsp;To perform the fork, Vidar first opens a handle to the target browser via <code>OpenProcess</code> with <code>PROCESS_QUERY_INFORMATION | PROCESS_CREATE_PROCESS | PROCESS_VM_READ</code>, falling back to <code>PROCESS_CREATE_PROCESS</code> if the initial call fails. It then passes this handle as the <code>ParentProcess</code> argument to <code>NtCreateProcessEx</code>, requesting <code>PROCESS_ALL_ACCESS</code> on the resulting child. If the fork fails, Vidar falls back to scanning the live browser process directly.&nbsp;

If no target browser process is found running, Vidar creates a new isolated desktop via <code>CreateDesktopA</code>, assigns it a name of the form <code>v20_%d</code> (where <code>%d</code> is replaced with the browser’s index in Vidar’s configuration), and launches the target browser in there. In the case of Vidar version 2.1, the browser is launched with the command line <code>--no-first-run --disable-gpu about:blank</code>, although the exact command line varies across versions. Since modern browsers use a multi-process architecture, there are typically multiple processes matching a given browser. Vidar enumerates all of them (up to 64) and applies the fork-and-scan procedure to each one independently.&nbsp;

With a handle to the forked process in hand, Vidar proceeds to enumerate its virtual memory regions using <code>NtQueryVirtualMemory</code>. It iterates through the entire browser’s address space, collecting regions that match a specific profile: committed (<code>MEM_COMMIT</code>), private (<code>MEM_PRIVATE</code>), and either readable (<code>PAGE_READONLY</code>) or read-write (<code>PAGE_READWRITE</code>). Vidar records up to 4096 memory regions matching these requirements, along with their base addresses and sizes. The actual pattern scanning is then performed in parallel with up to 64 worker threads, depending on the system.&nbsp;&nbsp;

Each thread scans its assigned regions using <code>NtReadVirtualMemory</code>, searching for a 32-byte pattern. When a match is found, the thread reads 8 bytes at offset +32 from the match, interprets them as a pointer, and validates that it points to committed, private, and readable memory (the expected memory state for the encrypted <code>v20_master_key</code>).&nbsp;&nbsp;

This naturally raises the question of what pattern Vidar searches for. The answer is a 32-byte signature: <code>76 32 30 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 00 00 00 00 01 ?? ?? ??</code>, where <code>??</code> denotes a wildcard (Vidar uses the byte <code>AA</code> as the wildcard marker in its internal representation). Notably, the first four bytes correspond to the ASCII <code>v20\x00</code>, which is a common prefix used for ABE-related data.&nbsp;&nbsp;

We assess with high confidence that this pattern is intended to match a node structure within Chromium’s <code>Encryptor::KeyRing</code>, the structure that holds the keys used by the <code>Encryptor</code> class. Now, this part is admittedly a bit tricky as it relies on several assumptions we made about the internal memory layout, as well as on implementation-specific representations of various C++ standard library types <code>(std::map</code>, <code>std::string</code>, <code>std::vector</code>, <code>std::optional</code>), which is why we frame this as a high-confidence rather than a certainty.&nbsp;&nbsp;Our reasoning is as follows: <code>KeyRing</code> is <a href="https://github.com/chromium/chromium/blob/cf5d502bcaedb22927e3829a18be1ff6d8b6f598/components/os_crypt/async/common/encryptor.h#L132" target="_blank" rel="noreferrer noopener">defined</a> as <code>std::map&lt;/*tag=*/std::string, std::optional&lt;Key&gt;&gt;</code>, and <code>std::map</code> is typically implemented as a red-black tree, where each tree node stores three pointers (left child, parent, and right child) followed by the key-value pair. In this case, the pair is in the form of <code>std::pair&lt;/*tag=*/std::string, std::optional&lt;Key&gt;&gt;</code>, meaning that the <code>std::string</code> and the <code>Key</code> object might be laid out consecutively in memory within each node. For a <code>v20_master_key</code> entry, the tag corresponds to the string <code>v20</code>, which at 4 bytes including the null terminator fits within the small string optimization (SSO) buffer and is therefore stored inline rather than heap-allocated. The <code>Key</code> class that immediately follows <a href="https://github.com/chromium/chromium/blob/cf5d502bcaedb22927e3829a18be1ff6d8b6f598/components/os_crypt/async/common/encryptor.h#L93-L98" target="_blank" rel="noreferrer noopener">contains three member variables</a>: <code>std::optional&lt;mojom::Algorithm&gt; algorithm_</code>, <code>std::vector&lt;uint8_t&gt; key_</code>, and <code>bool encrypted_ = false</code>.&nbsp;Putting it all together and applying it to a concrete example from a browser memory dump, we get the following layout:&nbsp;

Please note that while the exact layout may contain minor inaccuracies on our part, the overall structure should be roughly correct. For easier orientation, the following diagram illustrates how the individual structures are nested within each other:&nbsp;

At this point, it should be clear how the scan pattern maps onto the searched structure. The 32-byte match covers the <code>std::string</code> tag <code>v20\x00</code> and the beginning of the <code>Key</code> object up to and including <code>algorithm_</code>. The pointer at offset +32 from the start of the match then lands precisely on <code>key_.begin</code>, the first member of <code>std::vector&lt;uint8_t&gt;</code> that holds the encrypted <code>v20_master_key</code>.&nbsp;Matches from all threads are collected into a shared buffer and subjected to a majority-voting scheme: candidates consisting mostly of zeroes are discarded, the rest are pairwise-compared, and each is scored by the number of identical copies found. This voting is performed independently for each browser process, producing one best candidate per process.&nbsp;<h2>Decrypting the v20_master_key via APC Injections&nbsp;</h2>For each browser process that produced a match, Vidar now holds a candidate address pointing to a potential encrypted <code>v20_master_key</code>. However, as already noted, since the key is protected with <code>CryptProtectMemory</code> using <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code>, it can only be decrypted by invoking <code>CryptUnprotectMemory</code> from within the browser process itself. Vidar solves this by injecting an Asynchronous Procedure Call (APC) into the live browser process.&nbsp;Vidar supports two APC injection methods, selected based on whether ESET or Bitdefender is detected on the system. If either of these products is present, Vidar uses the first method, which it refers to as “classic” (based on decrypted strings) – it creates a suspended thread in the target browser via <code>CreateRemoteThread</code> (with <code>NtTestAlert</code> as the thread start address and the <code>CREATE_SUSPENDED</code> flag), queues an APC using <code>NtQueueApcThread</code>, resumes the thread, and then waits for it to complete via <code>WaitForSingleObject</code> with a randomized timeout. When the thread resumes, it calls <code>NtTestAlert</code>, which flushes the APC queue and executes the injected routine.&nbsp;

If neither product is detected, it uses the “special” method – it finds an existing thread in the target browser using a combination of <code>CreateToolhelp32Snapshot</code> and <code>Thread32First/Thread32Next</code>, opens it via <code>NtOpenThread</code>, and calls <code>NtQueueApcThreadEx2</code> with the <code>QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC</code> flag. Unlike regular APCs, special user APCs execute immediately. Therefore, the target thread does not need to be in an alertable wait state.&nbsp;

In both cases, the APC routine to be executed is <code>CryptUnprotectMemory</code>, called with the following three arguments: the address of the encrypted <code>v20_master_key</code> candidate, its size (32 bytes), and <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code> for the <code>flags</code> parameter.&nbsp;&nbsp;Since <code>CryptUnprotectMemory</code> decrypts the data in place, once the APC executes, the key is decrypted directly in the live browser's memory. To read it, Vidar creates a second fork of the browser process and reads the key from the same address using <code>NtReadVirtualMemory</code>. It then compares the result against a snapshot of the encrypted key taken from the first fork before the APC call – if the data is unchanged, decryption failed, and Vidar moves on to the next browser process’s candidate.&nbsp;If the data differs, Vidar uses the same second fork to perform an additional verification: it scans the forked process’s memory for the byte sequence <code>v20</code> and, treating each match as a potentially ABE-encrypted entry (cookie, password), attempts AES-256-GCM decryption with the key candidate using <code>BCryptDecrypt</code> (successful GCM tag verification confirms that the key is correct).&nbsp;Whenever the data has changed (indicating that decryption of the key took place), Vidar re-encrypts the key in the browser’s memory by injecting another APC with <code>CryptProtectMemory</code> as the routine, preserving the browser’s state. If no candidate produced a successful decryption (i.e., the data remained unchanged after every APC call), Vidar takes a more aggressive approach: it terminates all browser instances, restarts the browser, and repeats the entire scan-decrypt-verify cycle.&nbsp;By abusing APC injections instead of the more traditional approach of injecting code via <code>NtWriteVirtualMemory</code> that performs the decryption, Vidar trades one suspicious behavior for another. APC injections are arguably less common and may thus slip past some detection systems, though they are still well-known techniques monitored by AV and EDR solutions. But that is the nature of ABE bypasses – each has its own advantages and disadvantages, and that’s exactly why infostealers keep inventing new ones. &nbsp;<h2>Indicator of Compromise (IoC)&nbsp;</h2>459daa809751e73f60fbbe4384a7d1653c36bb06945e4eb3635270924241100a (Vidar 2.1)&nbsp;

A Technical Walkthrough of How Vidar Defeats Application-Bound Encryption

Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections

You have a summer flight booked. You have seen the headlines about jet fuel shortages, cancelled routes and higher travel costs. Then a text message arrives: your flight has been affected, and you need to click a link to confirm your refund or rebook before the offer expires.&nbsp;That message feels plausible because the situation around it is real. In April, <a href="https://www.iata.org/en/pressroom/2026-releases/2026-04-17-01/" target="_blank" rel="noreferrer noopener">IATA warned</a> that Europe could start seeing flight cancellations by the end of May if jet fuel shortages materialized. Airlines and governments have since been trying to reassure travelers, while also publishing guidance on passenger rights, refunds and re-routing.&nbsp;&nbsp;That is exactly the kind of confusion scammers like. They do not need to cause the disruption, they only need to arrive at the right moment, with the right brand logo and the right sense of urgency.&nbsp;<h4>Why travel disruption works so well as a scam hook&nbsp;</h4>Most scam messages fail because they arrive out of context. A random refund email from an airline you never use is easy to ignore. A refund message from the airline you are flying with next week, during a period of public travel disruption, is different.&nbsp;The scammer’s job is to make you think: “This could be real.”&nbsp;That can happen in several ways. You might receive a fake cancellation email that links to a refund form. You might search for an airline’s customer service number and land on a fake support page. You might post publicly on social media asking an airline for help, then receive a reply from an account that looks official. Or you might get a WhatsApp message that knows your hotel name, travel dates or booking reference.&nbsp;Each version uses the same pressure point: you are worried about losing money, losing your flight or being stranded.&nbsp;Criminals are already using disruption this way. In March, <a href="https://www.theguardian.com/money/2026/mar/15/travel-scam-airline-accounts-fake-refunds-iran-war-flight-disruption" target="_blank" rel="noreferrer noopener">The Guardian reported</a> that fake airline support accounts were targeting travelers affected by Middle East flight disruption. Some victims were looking for help or refunds, then received replies from accounts pretending to represent airlines. The scam moved into direct messages, where victims were asked for details and sent links that led to money being taken instead of refunded.&nbsp;&nbsp;The jet fuel story gives scammers another pretext. A message can claim that your flight was cancelled, your fare changed, your fuel surcharge failed, or your refund must be claimed within a few hours. None of those claims needs to be true to be effective.&nbsp;<h4>The scam may start before the message arrives&nbsp;</h4>A fake travel message becomes much harder to spot when it includes real information.&nbsp;This is the idea behind <a href="https://www.gendigital.com/blog/insights/research/reservation-hijack-scam" target="_blank" rel="noreferrer noopener">Reservation Hijack scams</a>, a form of targeted phishing where cybercriminals use real booking details to make a message look legitimate. In some cases, attackers may use information exposed through breaches or compromised travel systems. In other cases, they collect details from emails, social media posts, previous leaks or fake customer service interactions. Gen has previously described Reservation Hijack scams as scams that use real hotel booking details to make fraudulent payment or verification requests feel authentic.&nbsp;&nbsp;That distinction matters. A scam message does not need your credit card number to fool you. Knowing your name, your destination, your travel dates and your booking platform may be enough.&nbsp;<h4>What these scams can look like&nbsp;</h4>A travel disruption scam usually does not begin with a strange offer. It begins with something boring and administrative. That is part of the trick.&nbsp;You may see messages like:&nbsp;“Your flight has been cancelled due to fuel supply issues. Claim your refund here.”&nbsp;“Your rebooking is pending. Confirm passenger details within two hours.”&nbsp;“Additional airport tax or fuel surcharge is required to keep your booking.”&nbsp;“Your hotel reservation will be cancelled unless payment is verified.”&nbsp;“Due to high call volume, please continue this request on WhatsApp.”&nbsp;The exact wording changes, but the structure is familiar. There is a problem, a deadline and a link. The message may also move you away from the official channel into SMS, WhatsApp, Telegram, direct messages or a phone call. Once that happens, the scammer controls the conversation.&nbsp;There is another detail worth watching: some messages do not ask for money immediately. They start by asking for your booking reference, last name, phone number or one-time password. That can still be dangerous. Those details can help scammers access a booking, impersonate you to customer support, reset an account or make the next message more convincing.&nbsp;<h4>Your real passenger rights can be used against you&nbsp;</h4>If an airline cancels your flight, you may have rights to a refund, re-routing or assistance, depending on where you are travelling and the rules that apply. The European Commission said passengers affected by cancellations continue to have rights to reimbursement, re-routing or return, airport assistance and compensation for last-minute cancellations in relevant circumstances. It also said airlines cannot retroactively add fuel surcharges to already published final ticket prices.&nbsp;&nbsp;That information is useful for travelers, but it is also useful for scammers.&nbsp;A fake refund message becomes more believable when people already know refunds are possible. A fake rebooking link becomes more believable when airlines are genuinely changing schedules. A fake “fuel surcharge” demand becomes more dangerous when fuel prices are in the news, even though legitimate retroactive charges may not be allowed in many cases.&nbsp;This is why the safest route is not to judge the message only by whether the story sounds plausible. During travel disruption, many scam stories will sound plausible. Judge the channel instead.&nbsp;<h4>How to check before you click&nbsp;</h4>Start from the airline or booking platform’s official app or website. Do not use the link in the message. Open the app yourself, type the website address yourself, or use the contact details listed on your original booking confirmation.&nbsp;Check whether the same cancellation, refund or payment request appears inside your account. If the message is real, the airline or hotel should be able to confirm it through an official channel.&nbsp;Be careful with social media support. If an account replies to your public complaint, check whether it is linked from the airline’s official website. Look at the handle carefully. Fake support accounts often copy logos and names, but have small differences in spelling, low follower counts or recently created profiles. The Guardian reported that fraudsters often scan social media for passengers trying to contact legitimate airline accounts and reply to them first, which makes the scam harder to spot.&nbsp;&nbsp;Do not share one-time passwords, payment card details or login credentials with anyone who contacts you unexpectedly. A real airline or hotel does not need your banking OTP to send you a refund.&nbsp;Be especially suspicious of pressure. “You have 30 minutes to claim your refund” is not customer service. It is a tactic.&nbsp;<h4>What to do if you already clicked&nbsp;</h4>If you entered payment details, contact your bank or card provider immediately. Ask whether the transaction can be blocked or reversed, and request a new card if needed.&nbsp;If you shared login details for an airline, hotel or booking platform, change the password from the official site or app. Use a unique password, not one you use elsewhere. Turn on two-factor authentication where it is available.&nbsp;If you shared a one-time password or authentication code, assume the account may have been accessed. Check your booking details, payment methods and recent account activity.&nbsp;Report the scam to the airline, hotel or booking platform being impersonated. If the scam came through social media, report the account as impersonation. If money was taken, report it to the relevant fraud authority in your country.&nbsp;<h4>The real lesson for summer travel&nbsp;</h4>Travel disruption changes how people behave. They search for support numbers in a hurry. They post publicly because customer service queues are long. They accept strange instructions because they are worried about losing a flight or refund.&nbsp;Scammers build around that behavior.&nbsp;The safest assumption is simple: if a message about your flight, hotel or refund creates urgency and gives you a link, pause. Go back to the official source. A real cancellation will still be there when you check through the airline or booking platform. A scammer needs you to act before you do.&nbsp;

Travel disruption gives scammers the one thing they need most: a believable reason to rush you

Your flight was cancelled. Is the refund message real? 

A fake job interview page is easier to trust than a fake ticket shop.In samples reviewed by Gen threat researchers, scammers used branded hiring pages that looked like ordinary recruitment flows: a company logo, a recruiter profile, a 30-minute meeting, and a button to continue with Google or Facebook. There was no attachment to open and no software to install. The credential theft attempt sat inside a step many job applicants already expect: signing in to schedule a call.FIFA is an obvious lure ahead of the 2026 World Cup. On May 22, ESET reported fake FIFA-themed websites that copied ticket and merchandise flows to steal money and personal data. Our researchers later found another FIFA-themed domain, hxxps://fifa-mg[.]shop, which followed a naming pattern not mentioned in that report. Domains like these can be short-lived, often appearing for hours or days before they are blocked, abandoned, or taken down.Our researchers also found a different kind of FIFA lure: hxxps://fifahiring[.]com, a fake hiring page that encouraged users to schedule a call with an alleged FIFA recruiter. When a user tried to register with a personal Gmail address, the page asked for a business email instead. The page was steering victims toward credentials with more value: accounts that could provide access to a company environment.

<h4>The FIFA hiring page did not point to FIFA</h4>The fake page looked believable at first glance.

It used FIFA branding, presented a recruiter identity, and copied parts of the experience users see on legitimate recruiting and scheduling platforms. The recruiter’s name and photo appeared to match a real LinkedIn profile, which made the page feel more credible. For publication, we should keep that person’s identity redacted.The domain did not match FIFA’s real hiring infrastructure. FIFA’s legitimate careers pages are jobs.fifa.com and fifa.pinpointhq.com. The fake page used neither. It also loaded the favicon from the real FIFA recruitment site hosted at pinpointhq.com, giving the page a small visual cue borrowed from the legitimate service.Other signals pointed in the same direction. The domain and certificate were newly created, from May 23. The site used commodity hosting infrastructure, including Vercel and Render, rather than a corporate environment. Those signs are not enough on their own, but they fit the rest of the evidence.The login flow was the clearest part. Credentials were posted to:fifeq2026eqbackeq[.]onrender[.]com/api/loginThe Google sign-in prompt was not a real Google authentication window. It was rendered inside the page itself. The visible controls and links did nothing, and the page did not send the user into a genuine Google sign-in flow. According to the analysis, the only Google asset loaded was the favicon, apparently to make the fake window look familiar.A page can look like it opened a Google login without ever handing control to Google.Researchers also observed hxxps://careers-fifahiring[.]com, which later became inactive, and hxxps://fifajobs[.]com, which showed the same content and was indexed by Google.&nbsp;<h4>The recruitment lure went beyond FIFA</h4>The FIFA page was one version of a wider recruitment phishing pattern. The brand can change. The flow stays familiar: recruiter profile, meeting prompt, business email, fake sign-in.Researchers found similar fake hiring pages abusing other major brands, including Heineken, Hilton, Coca-Cola, Netflix, PepsiCo, Delta,&nbsp;and Spotify. In the Heineken case, the page appeared to use the identity of someone who, according to LinkedIn, really works as a recruiter at the company.

Additional hunting found two other recruitment-themed kits:hxxps://aquent-talent-jobs[.]com hxxps://hays-talent-opportunities[.]comThe Hays-themed version targeted Facebook credentials instead of Google credentials. Researchers assessed that the Aquent and Hays pages shared code, although they differed from the earlier FIFA examples.

This flexibility makes the campaign harder to frame as a single World Cup scam. FIFA provides the timely hook, but the mechanism is recruitment phishing. A scammer can swap the logo, recruiter name, and sign-in provider while keeping the same basic path to the victim’s credentials.<h4>Why fake recruitment pages work</h4>Recruitment gives attackers a clean excuse to ask for things that might otherwise raise suspicion.A candidate expects to click a scheduling link. They expect a recruiter profile. They expect a calendar prompt. In some cases, they may also expect to use a work email, especially for corporate, contractor, or partner-facing roles.The fake login window turns that ordinary flow into credential theft. Users are used to “Continue with Google” and “Continue with Facebook” buttons, but the button itself proves nothing. A genuine authentication flow should take the user to the provider’s domain and controls. A fake page can draw a convincing copy while keeping the victim inside the attacker-controlled site.The business email prompt is also a warning sign. A page that rejects a personal email and asks for a work address may be trying to raise the value of the stolen account.<h4>What job seekers should check before signing in</h4>Start from the company’s official careers page, not from a link in a message, ad, search result, or forwarded post. For FIFA, that means checking jobs.fifa.com or fifa.pinpointhq.com, not trusting a domain because it contains “fifa,” “career,” “hiring,” or “jobs.”Look closely at the domain before entering credentials. Scam pages often add plausible hiring words around a brand name: career, talent, jobs, hiring, portal, or connect. A polished page on a new domain is still a new domain.Treat the sign-in step as the real checkpoint. If a page offers Google or Facebook login, check whether the flow actually opens a real provider-controlled authentication page. A fake window embedded inside the original site, broken controls, inactive links, or a provider logo used only as decoration should stop the process.Use security software that includes web and phishing protection. These tools can block known malicious pages before they load, which is especially useful when scam domains look polished, appear in search results, or are shared through otherwise legitimate channels.<h4>What companies can do</h4>Recruitment pages are public by design, which makes them easy to copy.Security teams should monitor for newly registered domains combining their brand with hiring-related terms. They should also watch for pages that reuse favicons, recruiter photos, job descriptions, and calendar-booking language from legitimate hiring flows.HR and recruiting teams should make the official hiring path easy to verify. Candidates should not have to guess whether a domain is legitimate. A clear careers page, consistent recruiter communication, and warnings about unofficial scheduling links can remove some of the ambiguity attackers rely on.<h4>Conclusion</h4>The fake FIFA hiring page worked because it did not feel unusual. It looked like a normal step in a hiring process.Attackers do not need to invent new behavior when they can copy one people already trust. A branded scheduling page, a recruiter profile, and a familiar sign-in button can be enough to move a victim from interest to credential entry.The decision point is the login. Before entering a work email or password, check the domain, check where the authentication flow really goes, and verify the role through the company’s official careers site. Security software with web and phishing protection adds another layer, especially against short-lived scam pages that may only stay online for hours or days.IOCs:hxxps://fifahiring[.]com hxxps://careers-fifahiring[.]com hxxps://fifajobs[.]com hxxps://fifa-mg[.]shop hxxps://heineken-careers[.]com hxxps://aquent-talent-jobs[.]com hxxps://hays-talent-opportunities[.]com fifeq2026eqbackeq[.]onrender[.]com/api/login

Scammers are copying recruitment and calendar-booking flows to make fake Google and Facebook sign-ins look routine. 

Fake hiring pages abuse FIFA and other major brands to steal work credentials 

Threat Research Team Lead

Since January 2026, we have detected 7.4 million malicious incidents tied to residential proxy traffic, affecting 572,000 users in our telemetry. In this model, the household whose connection is being used is often not the buyer of the traffic. It is the exit point.That is the uncomfortable part of residential proxy networks. A home router, laptop, phone, smart TV, or other always-on device can quietly become part of a commercial network that routes strangers’ internet traffic through ordinary consumer IP addresses. To the websites on the other end, that traffic looks as if it came from a real household, because it did.The technology itself is not inherently malicious. Businesses use residential proxies for market research, ad verification, brand protection, security testing, and services that need to see the web as a real user would. But the same feature that makes these networks useful also makes them attractive for abuse: traffic from a household IP address is hard to block without risking false positives against legitimate users.The problem for consumers is simpler. Many people do not realize their device or connection can be enrolled into this kind of network at all. Some users opt in through pay-for-bandwidth apps. Others are enrolled through “free” VPNs, bundled software development kits inside unrelated apps, or unwanted software that installs proxy components without meaningful consent.Here is how the market works, who pays for it, and what it can cost the household that unknowingly hosts it.<h2>What is a residential proxy</h2>A residential proxy is an internet connection – typically a home laptop, phone, smart TV, or router – that has been enrolled into a third-party network and is being used to route someone else's traffic. To the rest of the internet, that traffic looks like it is coming from an ordinary household IP address assigned by a consumer ISP, not from a datacenter or&nbsp;VPN provider.Residential proxy networks are sold commercially. The model is two-sided: some people pay to tunnel their traffic out through someone else's connection (much like a VPN, except the exit point is a real home), while others get paid to provide those exit endpoints. Some are structured as paid peer-to-peer networks, where any participant's connection can serve as an exit for any other.Buyers pay for access to pools of millions of these "real user" IPs because they are extremely difficult to block, or rather, blocking them carries real consequences: the traffic originates from genuine households, so any block risks shutting out a legitimate user – effectively a false positive.Common buyers include market research firms, price-comparison services, brand-protection vendors, security teams testing their own defenses, and consumer privacy tools. At the abusive end of the market, the same infrastructure used by operators running automated purchasing bots, scrapping campaigns, ad fraud, credential stuffing, phishing and other attacks where hiding the true origin of the traffic matters. Demand is also being shaped by large-scale web scraping, including&nbsp;<a href="https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/">scraping for AI training data</a>. As anti-bot systems become better at identifying traffic from datacenters and known VPN providers, residential IP addresses become more attractive because they look like ordinary users. That does not make every residential proxy user malicious. It does mean consumers may be carrying traffic for businesses and actors they have never heard of.<h2>How consumer devices end up in these networks</h2>There are several ways a home device can become part of a residential proxy network. Some are explicit. Others are easy to miss.The most obvious route is the pay-for-bandwidth model. Apps such as Honeygain, IPRoyal Pawns, and PacketStream pay users to share their internet connection. The user opts in, but they may not understand who will buy access to that connection later, what kind of traffic will pass through it, or what happens if that traffic triggers abuse reports.A second route is the “free” VPN or proxy app. Instead of charging a subscription, the app monetizes the user’s connection by reselling bandwidth. In practice, the user may think they are getting a privacy tool while also becoming infrastructure for other people’s traffic.A third route is through bundled software development kits, or SDKs. A developer adds a third-party component to an otherwise unrelated app, such as a flashlight, wallpaper, game, or utility. The developer gets paid when the app is active. The user sees the host app, not the proxy network behind it.The fourth route is malware or potentially unwanted software. In those cases, the proxy component is installed silently or deceptively, with no meaningful user consent at all.<h2>Why the "consent" is rarely meaningful</h2>Even when consent technically exists, it is often not the kind of consent most people would recognize.The disclosure may be buried in a long terms-of-service document. The wording may be vague, with phrases such as “share your unused bandwidth,” “support the app,” or “join our network.” These phrases do not clearly tell the user that arbitrary third parties may route traffic through the user’s home IP address.There is also the question of downstream use. Users are rarely told who buys access to the network or what those buyers do with it. Their connection could be used for benign market research. It could also be used for scraping, automated account creation, ad fraud, credential stuffing, or phishing infrastructure.The problem gets worse when the proxy component sits inside another app. The host app’s privacy policy may mention a partner SDK by brand name, but that still does not make it clear to a normal user that their device can become a proxy endpoint.Uninstalling the visible app may not always resolve the issue cleanly either, especially when proxy components are installed separately or bundled with other unwanted software.<h2>The risks consumers actually carry</h2>When a household device becomes a residential proxy node, the user takes on risks created by someone else’s traffic.The first risk is attribution. Abusive, fraudulent, or illegal activity routed through the device appears to come from the household’s IP address. ISP abuse notices, platform bans, fraud checks, and law enforcement requests point first to the subscriber, not to the person who bought the proxy traffic.The second risk is performance. Continuous third-party traffic can consume bandwidth, slow the home network, hit data caps, or violate ISP terms of service. The user may only notice that the internet feels slower, a bill is higher, or a service suddenly blocks access.The third risk is security exposure. Proxy clients run persistent background processes and maintain network connections so they can relay traffic. That adds always-on networking software to the device, often with limited visibility for the user.The fourth risk is reputation. A home IP address used for abuse can end up on blocklists used by banks, retailers, streaming services, and online platforms. The result can be account friction, failed logins, extra verification steps, or outright blocking from services the household actually uses.There is also a family angle. A child or another household member may install a free game, VPN, or utility without understanding the consequences. The legal, financial, and reputational risk still lands on the account holder.<h2>What our telemetry shows</h2>Since the beginning of 2026, we have detected 7.4 million malicious traffic incidents associated with residential proxy traffic, affecting 572,000 unique users in our user base.&nbsp; This is not a measurement of the entire residential proxy market. It reflects what we observe in our telemetry: malicious traffic, detections, and related activity affecting protected users. The real footprint is far larger, because residential proxy networks span major consumer platforms and many devices outside our visibility.The activity is global, but it is concentrated in a smaller set of countries. India leads by a wide margin, with roughly 83,000 affected users, followed by Vietnam with 61,000 and Brazil with 39,000. The Philippines (23,000), Poland (18,000), Indonesia (18,000) and Thailand (14,000) form a second tier, with Egypt, Spain, Ukraine, Argentina, Mexico and Italy each accounting for 10,000 to 13,000. The spread across South and Southeast Asia, Latin America, and Eastern and Southern Europe reflects where the host apps that carry this software are most widely installed.That geographic spread likely reflects a combination of app distribution, local install patterns, user appetite for free or pay-for-bandwidth apps, and the economics of bandwidth resale. It should not be read as a simple ranking of where residential proxy abuse originates.The chart below breaks down the threats we observed in this proxy-related traffic. Two categories dominate: phishing and malicious advertising. Behind them sits a long tail of consumer-facing fraud, including e-shop scams, generic scams, financial scams, and fake-tutorial pages, alongside outright malware such as trojans and other malicious traffic.&nbsp;

In the malicious proxy traffic we observed, scams and malware dominate. The important point for consumers is not only that their connection may be used by someone else. It is that, when abuse happens, their household IP address can be the return address.<h2>What consumers can do</h2>Most people will not identify a residential proxy component by name. But there are practical warning signs.Review “free” VPNs, proxy apps, bandwidth-sharing apps, and utilities from unknown publishers. Check whether they mention bandwidth sharing, peer-to-peer networking, traffic routing, or network participation in their terms. If an app offers payment for leaving your device online, assume your connection may be resold unless the provider explains exactly how traffic is vetted and who can buy access.On phones and computers, remove apps you do not recognize or no longer use. On home routers, check the list of connected devices and look for anything unfamiliar. If your ISP sends abuse notices, websites start blocking you, or your home IP address suddenly fails fraud checks, a proxy component is one possible explanation.Security software can also help by detecting unwanted proxy clients, bundled components, and related malicious activity. But this should not be a guessing game for consumers. Software that turns a household connection into a commercial exit node should be named clearly and made easy to remove.<h2>The takeaway&nbsp;</h2>With residential proxiesthe user’s connection becomes an infrastructure for someone else’s business.The issue is not that residential proxy technology exists. It has legitimate uses. The issue is whether people know when their devices are part of it, understand what kind of traffic may pass through their connection, and have a real choice to opt out.The fix is not to pretend consumers will read every EULA. This software should be named clearly, shown plainly, and made easy to remove before a household connection becomes someone else’s infrastructure.

Your home connection could be routing traffic for strangers. Here's how residential proxy networks work, how devices get enrolled and what our telemetry reveals about the risks for consumers.

Who's Really Using Your Home Internet Connection?

<h4>Key Points&nbsp;</h4><ul><li data-list-item-id="e43a143fd054561c50dba51071686adff">Gen Threat Labs has been tracking GoFlateLoader, a widespread Golang loader used to deliver multiple infostealers, including Amatera, Remus, Lumma, Vidar and StealC.&nbsp;</li><li data-list-item-id="e3d3b5d0814ea5b26aa75a8d3d6013a39">GoFlateLoader appears both in x86 (32-bit) and x86-64 (64-bit) variants, matching the bitness of the payload it is supposed to execute.&nbsp;</li><li data-list-item-id="e51ccafcfb8c418d894aeb685004a0ba5">The loader is designed for in-memory payload execution and is deliberately inflated with a massive PE overlay to hinder detection</li><li data-list-item-id="ec4bafef8a1113d24bc2b4b3a943228d1">The two main delivery paths are via supposedly cracked software and a <a href="https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/" target="_blank" rel="noreferrer noopener">malicious TDS recently documented by Check Point Research</a>, which may redirect users to dedicated landing pages serving password-protected archives containing GoFlateLoader.&nbsp;</li></ul><h4>Introduction&nbsp;</h4>Not every threat that matters is technically sophisticated, and that is also the case with GoFlateLoader, which is a rather simple loader written in Go, whose sole purpose is to decode and execute the payload in memory. What stands out the most is not what the loader does but rather what it does not do – it comes without anti-debugging, anti-VM, or sandbox-evasion checks, and also lacks API hashing or CFG obfuscation, the kind of tricks that loaders almost always come with. Instead, GoFlateLoader relies on one of the simplest yet still effective tricks to stay under the radar – it appends a massive PE overlay at the end of the file, deliberately inflating the binary's size (hence the name GoFlateLoader).&nbsp;Nevertheless, it is important to understand that malware does not necessarily need to be elegant or stealthy. In the end, the only thing that matters to attackers is whether it can successfully deliver the final payload. And if that is the only metric, GoFlateLoader appears to be working fairly well for its operators, as we continue to see it widely distributed across our user base. Since the beginning of April, we have protected more than 33,000 unique users from it, with the most affected countries including Brazil, India, Argentina, Mexico, Turkey and Spain.&nbsp;

<h4>GoFlateLoader’s Execution Flow&nbsp;</h4>If we strip away the obfuscation noise that the Go compiler and the author’s decoy code add, the loader’s execution flow is short and linear:&nbsp;<ul type="disc"><li data-list-item-id="efa51af3b2859fd9c684efca0c82d3b66">Copy the encoded payload blob from the <code>.rdata</code> section onto the stack.&nbsp;</li><li data-list-item-id="e879bb970c6d1a81b8a42512222aceaa4">Decode the payload using a small, multi-stage, custom byte-level transformation into a valid PE.&nbsp;</li><li data-list-item-id="ebff4f340af15b75cbea0d682b26b7645">Parse the PE headers of the decoded payload (image base, image size, sections, data directories, etc.).&nbsp;</li><li data-list-item-id="e37fb26cad3d18a4a0c8bf9b2595d661f">Allocate an RWX memory region using <code>VirtualAlloc</code> with <code>MEM_COMMIT | MEM_RESERVE</code> and <code>PAGE_EXECUTE_READWRITE</code> flags, trying the payload’s preferred <code>ImageBase</code> first and falling back to an OS-assigned address if that fails.&nbsp;</li><li data-list-item-id="ebbde6d77cdc942c0a6bac79f4f8a6c28">Map the decoded payload into the allocated memory region by copying the PE headers first, then walking the section table and writing each section to its target virtual address.&nbsp;</li><li data-list-item-id="ed16738229e0f5c70a981c0c5f9b715f9">Apply relocations (only if preferred base mapping fails).&nbsp;</li><li data-list-item-id="e76cde4bae1be6c21b897c350c6fd15db">Resolve imports by walking the standard <code>IMAGE_IMPORT_DESCRIPTOR</code> table and rebuild the IAT in place via <code>LoadLibrary</code> and<code> GetProcAddress</code>.&nbsp;</li><li data-list-item-id="e786887a3d34fc7ce344ee8375944799e">Transfer execution to the final payload using Go’s <code>syscall.Syscall</code>.&nbsp;</li></ul>&nbsp;This is essentially a textbook example of manual PE loading with the payload reconstructed and executed entirely in memory so that it never touches the disk.&nbsp;&nbsp;

Notably, GoFlateLoader transfers execution to the final payload via <code>syscall.Syscall</code>. In Go, <code>syscall.Syscall</code> has the signature <code>Syscall(trap, nargs, a1, a2, a3)</code>, where <code>trap</code> is the function pointer to invoke, <code>nargs </code>is the argument count, and <code>a1</code>, <code>a2</code>, and <code>a3</code> are the first three arguments passed to the target function. Here, trap is set to point to the final payload’s entry point, <code>nargs</code> is set to <code>1</code>, and since the execution is transferred to that entry point, the remaining arguments serve only as filler values and are never used by the invoked payload. In other words, GoFlateLoader is not issuing a <code>syscall</code> at all, but abusing <code>syscall.Syscall</code> as a generic call gate to hand control to the payload.&nbsp;&nbsp;It is worth emphasizing that GoFlateLoader consistently sets these arguments to the hardcoded values <code>1</code>, <code>2</code>, <code>3</code>, and <code>4</code>, which is unusual enough to stand out as a potential detection opportunity (combined with other patterns).&nbsp;

The loader also carries substantial junk/decoy code, which varies across builds and serves no purpose other than padding the control flow and complicating static analysis.&nbsp;&nbsp;&nbsp;<h4>Inflated PE Overlay&nbsp;</h4>GoFlateLoader’s defining characteristic is its massive size (typically 700-950 MB), caused by an artificially inflated PE overlay appended to the original loader.&nbsp;

This is a deliberate design choice intended to bypass detection, as excessively large executable files may pose challenges for AVs and EDRs, primarily due to performance and resource constraints. As a result, to preserve performance and avoid noticeable impact to end users, these solutions often enforce practical file-size limits for deep scanning and/or emulation.&nbsp;The same logic extends to automated analysis pipelines – bloated files frequently cause timeouts during heuristic analysis and effectively prevent the sample from being uploaded to cloud-based sandboxes or threat intelligence platforms, which enforce their own strict upload limits to manage bandwidth and storage costs. A prime example is VirusTotal, which enforces a strict 650 MB upload limit. The fact that GoFlateLoader consistently sits just above this threshold strongly suggests that VirusTotal is one of the platforms it specifically aims to evade.&nbsp;&nbsp;In most cases, GoFlateLoader’s PE overlays are filled with null bytes, though we have also observed builds with random padding.&nbsp;&nbsp;

Crucially, adding such a PE overlay comes at virtually no distribution cost for attackers, as the inflated data compresses to a fraction of its original size (assuming constant padding).&nbsp;&nbsp;<h4>Delivered Final Payloads&nbsp;</h4>The final payloads distributed through GoFlateLoader are predominantly information stealers, with the most prevalent currently being Amatera, <a href="https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer" target="_blank" rel="noreferrer noopener">Remus</a>, and Lumma. Beyond these, we have also observed it distributing Vidar, StealC, and SvitStealer.&nbsp;GoFlateLoader comes in both x86 and x86-64 variants, with each variant matched to the architecture of the payload it is intended to execute.&nbsp;&nbsp;As for how GoFlateLoader binaries are distributed, we have observed at least two notable delivery paths. The first is through supposedly cracked software. The second involves the payload being served via <a href="https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/" target="_blank" rel="noreferrer noopener">the malicious TDS recently described by Check Point Research</a>, which redirects users to a landing page that offers a downloadable archive and separately displays the password required to extract it. This approach provides several advantages for the threat actor. First, compression significantly reduces the binary size due to the constant-padded PE overlay. Second, because the archive password is displayed separately on the landing page, it makes it harder for AV and EDR solutions to obtain it and decrypt the archive. As a result, the payload may remain concealed until the victim manually extracts it.&nbsp;&nbsp;&nbsp;<h4>Summary&nbsp;</h4>GoFlateLoader is a reminder that prevalence and sophistication are not the same thing. At its core, it is a rather simple manual in-memory PE loader written in Go, with no novel anti-analysis tricks under the hood. Whatever evasion it achieves comes not from obfuscation or other anti-analysis tricks but from its size – the appended PE overlay is built to slip past size-constrained scanners and automated analysis pipelines. Yet, despite its low level of sophistication, GoFlateLoader remains an active and relevant threat, used to deliver a wide range of prevalent information stealers.&nbsp;&nbsp;Gen products protect our users against both GoFlateLoader and the payloads it delivers.&nbsp;&nbsp;<h4>Indicators of Compromise (IoCs)&nbsp;</h4>Note: The files listed in the IoCs that are not archives all exceed 650 MB in size and are therefore not available on VirusTotal.&nbsp;b88c5744975d2abb447aecc6c090fee9f8580413f4612eecdc6ed1973e8a1739 (password-protected archive containing GoFlateLoader x64 variant loading Remus; pwd: 1234)&nbsp;ed5ae7f36453c5a23e9868a5729d67e0549a11f6dea54f5f52d654a8f51d4902 (archive containing GoFlateLoader x64 variant loading Remus)&nbsp;841c9297cb8a2e0ff89433d13c05bfc760eb2e98e251cb8fa785d2ad7cbac05f (archive containing GoFlateLoader x86 variant loading Amatera)&nbsp;ece7c48eb411b24f26762ede83badb4a644c41d5777129381ac2541804d64fc2 (archive containing GoFlateLoader x86 variant loading Lumma)&nbsp;421ce2d2f49c23bbe9f60ef3b9cd38d7eb912ce02e56a61837656210069bd9e2 (archive containing GoFlateLoader x64 variant loading Vidar)&nbsp;121c2dc793b3873f75a29ec02241f94136de19c049382a50a50d0d5b99507073 (GoFlateLoader x64 variant loading StealC)&nbsp;2415db5081cec9bfd14ad6da1a66169fd96f13a49010c319a73d1ed6fafd4efa (GoFlateLoader x64 variant loading Vidar)&nbsp;d9917ade3b4c125a95b5d3e6343cde26145dfbf569bd7e2a843fd0c6fc8ddc28 (GoFlateLoader x64 variant loading Remus)&nbsp;4cf6893756f441522b94b36f10e5de0e47aeed4743f95c51650746d1ecf97e3d (GoFlateLoader x64 variant loading SvitStealer)&nbsp;8b89d6c9152d3aab97aadd515ecb69ca72654db2f25425759ba4b646853d737d (GoFlateLoader x86 variant loading Lumma)&nbsp;90ce4ff9da23ac150da0a8e17930cab1e369aa349fdc1b65691b70369145664a (GoFlateLoader x86 variant loading Amatera)&nbsp;

 Intentionally Inflated Go Binaries That Use Massive PE Overlays to Bypass Detection

GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers

<h2>Key points</h2><ul type="disc"><li data-list-item-id="e4b810198ac9891110da1771c3f2d0397">Gen Threat Labs has identified Remus, a new 64-bit infostealer we attribute to the infamous Lumma Stealer family – emerging in the wake of Lumma’s takedown and the doxxing of its alleged core members.</li><li data-list-item-id="ede8006689bbfaba0d6fa856478b3ea79">In this technical blog post, we detail the compelling evidence tying Remus to Lumma across multiple dimensions.</li><li data-list-item-id="ef3f0d531ccf019ab00b98a38b3c43c17">We also describe a previously undocumented Application-Bound Encryption bypass employed specifically by Remus and Lumma.</li><li data-list-item-id="ee0040d0e9463ac082d24fcdbfd7af133">The first Remus campaigns date back to February 2026, with the malware switching from Steam/Telegram dead drop resolvers to EtherHiding and employing new anti-analysis checks.&nbsp;</li></ul><h2>Introduction</h2>When the security industry talks about information stealers, Lumma Stealer, without a doubt, has become the notorious icon of this landscape. Not only could it count itself among the most sophisticated, technically advanced, and widespread stealers-as-a-service in the world, but it was also described in a variety of blog posts from basically everyone in the industry, including us.In this analysis, we describe a new variant of Lumma Stealer that we call Remus, a new x64 build which we suspected might occur in the foreseeable future after the doxxing of Lumma authors from late August to October 2025. And the future is here.Remus brings the same stealing arsenal to the table as we already know from Lumma, capable of stealing stored browser passwords, cookies, cryptocurrency, and much more. However, rather than revisiting Lumma's well-documented capabilities, we focus on the remarkable resemblance between Remus and Lumma, as well as the new techniques Remus introduces, including the use of EtherHiding to resolve C2s, replacing the traditional use of Steam and Telegram dead drop resolvers, and additional anti-analysis checks.&nbsp;The attribution of Remus to Lumma is many-fold and described thoroughly throughout the blog post. The main indicators, to name a few, are the use of the same string obfuscation technique, AntiVM checks, direct syscall/sysenter handling, indirect control flow obfuscation, and, most importantly, an almost identical approach to bypassing AppBound Encryption, which we’ve only seen used explicitly by Lumma to date.With that said, we can still see active Lumma campaigns all around the world, which makes Remus not a replacement, but a continuous evolution.<h2>Development timeline</h2>Before diving into the technical details, it is worth noting that during our hunting efforts, we came across several test samples, which even carry a <code>testbuild</code> label embedded directly in the binaries (see Figure 1). We are internally referencing these builds as Tenzor (based on encrypted strings). These test builds are already 64-bit and structurally very close to Remus, suggesting they represent a transitional step, or perhaps even a testing ground, between Lumma and Remus.

This also brings us to the name itself. Both Tenzor and Remus have left a string artifact in the same part of the code, referencing the <code># TENZOR LOG</code> and <code># REMUS LOG</code> strings. Since we have been tracking only test builds with the Tenzor string and Remus is the variant that is being actively distributed in live campaigns, we took the liberty of naming the new x64 Lumma variant after the latter string – Remus.

Notably, all the Tenzor samples carry a build date of September 16, 2025, in their stack-encrypted strings, which is months before the first Remus samples began appearing in the wild at the turn of January and February 2026. The build timing closely coincides with a period when Lumma Stealer suffered a major blow through a doxxing campaign that exposed alleged core members and severely disrupted its operations. This may suggest that some of Lumma’s authors split off, or that Lumma decided to rebrand under a new name in the midst of the doxxing fallout. Nevertheless, at Gen Threat Labs, we track both Remus and Tenzor as variants of Lumma Stealer. That said, the only samples bearing the Tenzor name are the ones that also carry the <code>testbuild</code> label. All others are identified as Remus.

<h2>Similarities between Remus and Lumma</h2>When we first started analyzing Remus, something felt familiar, and for good reason. Many of the techniques and design patterns we encountered in Remus closely mirrored those we had already seen in Lumma Stealer. The main difference is that Lumma was 32-bit while Remus is 64-bit, which naturally introduced some variations. Yet, when we looked past the 32-bit versus 64-bit differences and stripped away the obfuscation layers, what remained was strikingly familiar.In the following subsections, we highlight the most compelling evidence of a direct connection between Remus and Lumma. Note that this is not an exhaustive list. The overlaps are far more numerous, but we selected just a few that we believe speak for themselves.<h3>Forgotten dead drop resolver and string obfuscation&nbsp;</h3>For a malware researcher, strings are among the most valuable resources during reverse engineering, and in the case of attributing Remus to Lumma, they proved no different.&nbsp;Both Remus and Lumma use a virtually identical mechanism for string obfuscation. The encrypted string is first assembled on the stack using a series of various forms of the <code>mov</code> instruction, followed by a decryption loop that transforms the data byte by byte. The transformation is often further obscured by MBA (Mixed Boolean-Arithmetic) obfuscation and is either inlined or placed in a standalone function. In any case, each string is protected using a unique transformation, making it very difficult to build a universal static decryptor. As a result, emulating the decryption loops is likely the most effective approach for dealing with encrypted strings in both Remus and Lumma.&nbsp;

Notably, the decryption loops are often preceded by several <code>nop</code> instructions (Lumma) or a single <code>nop</code> instruction encoded using multiple bytes (Remus), likely inserted as padding during a custom compilation pass. We are aware that the compilers themselves can emit <code>nop</code> paddings. Still, in both Remus and Lumma, these sequences go beyond the typical, making it yet another indicator linking the two together.After decrypting all strings in both Remus and Lumma and comparing them side by side, we found roughly 100 completely identical strings. Most of these, however, could be attributed to virtually any information stealer. The more telling discovery came when we looked at the strings that were not identical – most of them turned out to be semantically the same, just slightly refactored. This alone would already be a strong indicator.&nbsp;However, what ultimately confirmed our theory was shifting the string comparison from Lumma vs. Remus to Lumma vs. Tenzor, as Tenzor effectively acts as a bridge between the other two – many of the strings we had previously matched only semantically between Remus and Lumma were still present in Tenzor in their original, unmodified form, directly matching Lumma’s. At the same time, Tenzor also contained very specific strings found exclusively in Remus but not in Lumma, such as <code>B9%????4rnO/@NQe?Nx*</code>, used as a wildcard mask in the ABE-bypass (which we will discuss later), firmly linking it to both sides.

On top of that, among the decrypted Tenzor strings, we also found a Steam dead drop resolver <code>hxxps[://]steamcommunity[.]com/profiles/76561199861614181</code>, which turned out to be the exact same resolver present in multiple confirmed Lumma samples, namely:<ul><li data-list-item-id="e7c7ac2aae55af0df2c596fe8463f5a97">002f714f93bed53f165129a820c2d5b72227f1cafac43be19e5e223ce219a5e1 (Lumma)</li><li data-list-item-id="ea0c5ca160e92372f6b8b681415725a00">066c4ab954fc1270ee62c0d7c582c4c691e58e0ffef0c654bc204a46e440d16d (Lumma)</li><li data-list-item-id="e2eae0f6619eb5e4ffb9d1e84b3e057d6">0683f353cf3e101f721f1658e2a554ff7888ff9f2c32e23ceb3d23876864a264 (Lumma)</li><li data-list-item-id="efe40dcac54b87ce148882d49b97105a6">0580ebf601989457f0708799b431fd4d9f5e59d98838282d72936099aa6636da (Tenzor)</li></ul>

<h3>Application-bound encryption bypass</h3>Another very strong indicator tying Remus and Lumma together is the way they bypass Application-Bound Encryption (ABE), as both employ a highly specific technique that, until now, we have only observed and have been actively tracking in Lumma Stealer.The technique involves injecting a very short shellcode (less than 100 bytes) into the browser process to decrypt the <code>v20_master_key</code>. However, unlike most techniques relying on injection, Lumma as well as Remus do not use this shellcode to call <code>IElevator::Decrypt</code> with the key obtained from the <code>Local State</code> file (the <code>[“os_crypt”][“app_bound_encrypted_key”]</code> JSON field). Instead, it locates the <code>v20_master_key</code> directly in the browser’s process memory, where it is stored in an encrypted form protected by <code>CryptProtectMemory</code> with the <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code> flag. It then calls the complementary <code>CryptUnprotectMemory</code> with the same flag from within the browser’s context to decrypt it.It is important to note that this in-memory encrypted form of the <code>v20_master_key</code> is protected with a different key than the one used to protect the key on disk – it is a separate protection layer that Chromium browsers use to safeguard the key while it resides in memory at runtime. However, since the key is protected with the <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code> flag, decryption can only be performed by the same process that encrypted it, which is precisely why injection into the browser process is necessary in this specific bypass. For the curious, we discussed this topic in more detail in our recent&nbsp;<a href="https://www.gendigital.com/blog/insights/research/voidstealer-abe-bypass" target="_blank">VoidStealer blog post</a>.From this point on, we will walk through the ABE bypass as implemented in Remus, noting any differences from Lumma’s implementation where applicable. Where no differences are explicitly mentioned, the two implementations work either identically or very similarly.&nbsp;So how does Remus find the protected <code>v20_master_key</code>? It begins by walking the browser’s PEB module list, looking for two modules in a single pass: <code>dpapi.dll</code> and the browser DLL (e.g., <code>chrome.dll</code>).&nbsp;When <code>dpapi.dll</code> is found, Remus manually parses its PE export directory, reading the DOS header, PE header, and export table through repeated <code>NtReadVirtualMemory</code> syscalls. For each exported function name, it computes a seeded CRC32 hash and compares it against the pre-computed hash&nbsp;corresponding to&nbsp;<code>CryptUnprotectMemory</code>. Essentially, a typical API-hashing, but in a remote process. Once a match is found, it&nbsp;resolves the function’s RVA to obtain its absolute address in the browser’s address space.When the browser DLL is found during the same pass, Remus decrypts a hex pattern <code>488d058bcc8d02488901488b024889415b488d41</code>, which was encrypted by the same string obfuscation technique described earlier and stores the value <code>0xEFF87</code> (which corresponds to <code>11101111111110000111</code> in binary) into a variable we labeled as <code>wildcard_mask</code> (see&nbsp;Figure&nbsp;8).&nbsp;

The hex pattern corresponds to a sequence of opcodes that Remus searches for within the browser DLL (e.g., <code>chrome.dll</code>), while the wildcard mask, read from the least significant bit, indicates which bytes must match exactly and which should be treated as wildcards. Lumma does the same but takes a different approach to wildcarding. Instead of a hex mask, it uses a 20-character string <code>B9%????4rnO/@NQe?Nx*</code>, where ? denotes a wildcard and any other character means the byte must match exactly. Notably, this exact string also appears in Tenzor builds, which directly ties Tenzor to the Lumma codebase.

Looking into <code>chrome.dll</code>, we can see that the pattern is designed to locate a <code>LEA</code> (Load Effective Address) instruction that loads a 32-bit displacement pointing to the <code>os_crypt_async::Encryptor</code> virtual function table (vftable). The reason for specifically targeting the <code>os_crypt_async::Encryptor</code> class is that it holds the protected <code>v20_master_key</code>.

Once the pattern is found, Remus reads the 32-bit displacement at <code>pattern_address + 3</code> and computes the absolute address of the <code>os_crypt_async::Encryptor</code> vftable using the formula: <code>target_addr = pattern_addr + disp32 + 7</code> (since the <code>LEA</code> instruction is 7 bytes long and the displacement is relative to the next instruction).&nbsp;It then scans the browser’s memory for this 8-byte vftable pointer by enumerating committed, readable memory regions via <code>NtQueryVirtualMemory</code> and reading each one into a local buffer via <code>NtReadVirtualMemory</code>. Wherever a match is found, it marks the start of an <code>os_crypt_async::Encryptor</code> instance in memory, as the vftable pointer sits at the very beginning of the object. From there, extracting the protected <code>v20_master_key</code> is just a matter of walking the structure at known offsets.&nbsp;

After resolving all the necessary&nbsp;addresses, Remus allocates&nbsp;a buffer&nbsp;in the browser process via <code>NtAllocateVirtualMemory</code>, which serves as both the copy destination and the in-place decryption target.&nbsp;It then constructs&nbsp;a 51-byte&nbsp;shellcode (shown in Figure 12), allocates a second buffer with the <code>PAGE_EXECUTE_READWRITE</code> protection constant for the shellcode itself, and&nbsp;writes it into the browser process via <code>NtWriteVirtualMemory</code>. The shellcode is then executed via <code>NtCreateThreadEx</code>, and Remus waits for its completion using <code>NtWaitForSingleObject</code>.&nbsp;Once the <code>v20_master_key</code> is decrypted, Remus simply reads it from the buffer it previously allocated (and, therefore, already knows its&nbsp;address) via <code>NtReadVirtualMemory</code>.

The injected shellcode differs slightly between Remus and Lumma, but both fundamentally do the same thing – copy the protected <code>v20_master_key</code> into a pre-allocated buffer and jump to <code>CryptUnprotectMemory</code> to decrypt it in place. Both construct the shellcode on the stack, patching in the resolved addresses before writing it into the browser process. The only real difference is that Remus produces a more compact variant (51 vs 62 bytes) by reusing registers. Concrete examples of the injected shellcodes are shown in Figure 13 (Remus) and Figure 14 (Lumma).

Another detail linking the two is that when no browser process is already running, or when injection into an existing one fails, both Remus and Lumma spawn a new one on a separate, hidden desktop, preventing any visible windows from appearing on the user’s screen. They first attempt to open an existing desktop using <code>OpenDesktopW</code> and fall back to creating a new one via <code>CreateDesktopW</code> if it does not yet exist. A new browser instance is then launched via <code>CreateProcessW</code> with <code>STARTUPINFOW.lpDesktop</code> set to this desktop. The only difference is that Lumma uses a hardcoded desktop name&nbsp;<code>ChromiumDev</code> (or previously also <code>ChromeBuildTools</code>), while Remus generates a random 16-character alphanumeric string using a Mersenne Twister PRNG, a natural evolution rather than a change in approach.Furthermore, both Remus and Lumma also employ SYSTEM token impersonation as an alternative method to bypass ABE. Interestingly, the two families differ in which method they prefer: Remus attempts SYSTEM elevation first and falls back to shellcode injection, while Lumma tries injection first and resorts to SYSTEM elevation only if it fails. That said, SYSTEM token impersonation for ABE bypass is a well-known technique widely used across many stealer families. What, however, is highly distinctive is the injection-based bypass described above, which to our knowledge has only been used by Lumma and now also Remus.&nbsp;<h3>AntiVM CPUID checks</h3>Another identical technique shared by Remus and Lumma is their anti-VM check based on the&nbsp;<code>cpuid</code>&nbsp;instruction with&nbsp;<code>EAX</code>&nbsp;set to&nbsp;<code>0x40000000</code> – the hypervisor vendor identification leaf. When executed inside a virtual machine, the processor returns the hypervisor’s vendor signature in <code>EBX:ECX:EDX</code>. Both Remus and Lumma specifically check the&nbsp;<code>ECX</code>&nbsp;portion (4 bytes) against five known hypervisor signatures: KVM (<code>KVMKVMKVM</code>), QEMU/TCG (<code>TCGTCGTCGTCG</code>), VMware (<code>VMwareVMware</code>), VirtualBox (<code>VBoxVBoxVBox</code>), and Xen (<code>XenVMMXenVMM</code>). Notably, both check the same substrings of hypervisor names in the same order, and the checked substrings are obfuscated.&nbsp;The decompiled code performing the check can be seen in Figure 15 (Remus) and Figure 16 (Lumma). For clarity, we omitted the decryption loops from the Lumma listing, but they are the same decryption loops we described earlier.

<h3>Crypter check</h3>When executed without a protective layer, both Remus and Lumma display a warning dialog before proceeding with their malicious payloads (see Figures 17 and 18). The purpose of this mechanism is twofold: to discourage distributors from spreading the raw, unprotected executables, which are more easily detected by security products, and to prevent less skilled affiliates from accidentally infecting their own machines.

This type of check is relatively rare. So far, only a handful of families have been observed employing it – namely, <a href="https://outpost24.com/blog/lummac2-anti-sandbox-technique-trigonometry-human-detection/">Lumma</a>, <a href="https://research.checkpoint.com/2025/rhadamanthys-0-9-x-walk-through-the-updates/" target="_blank">Rhadamanthys</a>, Remus, and <a href="https://www.gendigital.com/blog/insights/research/defeating-aurastealer-obfuscation">more recently also AuraStealer</a>, albeit AuraStealer takes a slightly different approach (rather than simply displaying a warning and waiting for the user to click <code>Yes</code> or <code>OK</code>, it additionally requires the user to enter a randomly generated code shown in the dialog).&nbsp;However, despite the surface-level similarity, the underlying implementations differ. <a href="https://research.checkpoint.com/2025/rhadamanthys-0-9-x-walk-through-the-updates/">Rhadamanthys displays its warning dialog</a> using <code>MessageBoxW</code>, whereas both Remus and Lumma invoke it through a direct <code>NtRaiseHardError</code> syscall.&nbsp;<h3>Direct syscalls/sysenters</h3>Both Remus and Lumma make use of direct syscalls/sysenters. While their implementations differ in some details, mostly as a natural consequence of the 32-bit vs 64-bit architecture, the overall design is strikingly similar.One of the first things both do upon execution is that they enumerate all <code>Nt</code>-prefixed exports from <code>ntdll.dll</code> and build a lookup table mapping their name hashes to the corresponding Syscall Service Numbers (SSNs). The process is the same in both cases: they walk the <code>ntdll.dll</code> export directory, hash each matching export name, and scan the first 32&nbsp;bytes of each function’s prologue to extract the SSN from the <code>mov eax, &lt;SSN&gt;</code> instruction. The extracted SSN is then stored alongside the export’s name hash in a hash-to-SSN lookup table.&nbsp;

To invoke a specific syscall/sysenter, both perform a linear scan of the lookup table until they find an entry whose hash matches the requested function. The SSN from the matching entry is then passed to a central dispatcher, which we refer to as <code>lumma_sysenter</code> and <code>remus_syscall</code>. The calling conventions of those dispatcher functions are nearly identical: the first argument is the SSN, followed by the argument count and the variadic arguments themselves. The only difference is that Lumma expresses the argument count in bytes (<code>number_of_arguments × 4</code>), whereas Remus passes the actual count directly.

The dispatchers themselves look different at first glance, but this is mostly a consequence of ABI differences between 32-bit and 64-bit code. The core logic is the same: arrange the syscall/sysenter arguments and invoke the kernel. Remus does so directly via the&nbsp;<code>syscall</code>&nbsp;instruction. Lumma, on the other hand, resolves a dispatcher address during the hash-to-SSN initialization through a fallback chain: it first attempts to resolve the <code>Wow64Transition</code> export from <code>ntdll.dll</code> using API-hashing, then tries the <code>TEB-&gt;WOW32Reserved</code>, and finally, if that value is <code>NULL</code>, falls back to a hardcoded <code>sysenter</code>stub. Each of these fallback mechanisms ultimately achieves the same outcome – a transition from user-mode 32-bit code into the kernel.

Separately from the 32-bit <code>sysenter</code> dispatch, Lumma also employs Heaven’s Gate, a&nbsp;technique that allows 64-bit code to be executed from within a 32-bit process on a 64-bit operating system. Lumma uses it specifically when interacting with 64-bit browsers (during the ABE bypass) to call native 64-bit <code>ntdll.dll</code> functions that have no NtWow64 equivalents – namely <code>NtCreateThreadEx</code> to start the injected thread, <code>NtFreeVirtualMemory</code> for clean up, and <code>NtQueryVirtualMemory</code> to query the browser’s memory layout. The remaining cross-process operations, such as memory reads, memory allocations, and shellcode writes, are handled through standard NtWow64 sysenter calls (<code>NtWow64ReadVirtualMemory64</code>, <code>NtWow64AllocateVirtualMemory64</code>, and <code>NtWow64WriteVirtualMemory64</code>). Since Heaven’s Gate is inherently a WoW64 technique applicable only to 32-bit processes running on 64-bit systems, and Remus is a 64-bit binary, it has no equivalent. Remus simply uses direct syscalls for all these operations.<h3>Shared code patterns</h3>Another striking similarity is the layout of many functions, which shows a remarkable resemblance and, in some cases, is nearly identical (if we disregard the obfuscation and differences caused by 32-bit vs 64-bit code). While there are many such functions, we highlight two concrete examples. The first is the heap allocation wrapper, which Remus and Lumma implement in a virtually identical manner, as illustrated in Figures&nbsp;24 and 25. Furthermore, the same holds for other memory helpers, such as the reallocation and deallocation wrappers.&nbsp;

The second example is the clipboard-stealing routine (Figures 26 and 27). Both implementations follow the same sequence: they open the clipboard, retrieve its contents, convert it from UTF-16 to UTF-8, decrypt the output filename <code>Clipboard.txt</code> using a stack-based decryption loop, and finally append the result to the exfiltration archive. The only difference is that Remus wraps each API call in a thin stub, which, however, might just be a result of different compiler optimization.

Notably, although the vast majority of API calls are obfuscated through API hashing, the clipboard functions <code>OpenClipboard</code>, <code>GetClipboardData</code>, and <code>CloseClipboard</code> are among the very few unobfuscated imports in both binaries.Equally notable is the entry point structure. Both Remus and Lumma begin executing their malicious logic directly from the PE entry point (the&nbsp;<code>start</code>&nbsp;function), with no runtime initialization whatsoever. In a typical C/C++ binary, the entry point calls the CRT startup routine, which sets up the heap, initializes global variables, registers exception handlers, processes the command line, and invokes static constructors before eventually calling&nbsp;<code>main</code>. However, neither Remus nor Lumma follows this pattern. Instead, both jump directly from the entry point into their core logic: resolving modules and APIs, performing anti-analysis checks, initializing C2 communication, and exfiltrating data, ending with a direct call to <code>ExitProcess(0)</code>. This suggests both were compiled without linking to the standard C runtime, likely a deliberate choice to minimize the binary size and reduce unnecessary dependencies.The structural similarities extend further. Both binaries share the same section layout, with each section serving an identical semantic role. Even the C2 configuration follows the same pattern: in both cases, the encrypted blob, key, and nonce are statically embedded in the <code>.rdata</code> section and decrypted at runtime using ChaCha20.To summarize, we strongly believe the degree of similarity between the two codebases is too deliberate to be a coincidence, pointing to a single, shared origin.<h3>Indirect control flow obfuscation</h3>Finally, both Remus and Lumma make use of control flow obfuscation by replacing direct jumps with indirect ones, where the target is read from an offset stored in the <code>.data</code> section. As shown in Figure 28, this technique takes several forms. In its simplest case, the target address is resolved by a single pointer dereference (highlighted in yellow). In more complex cases, it extends to a full jump table, where a computed index selects among several target addresses stored consecutively in the <code>.data</code> section (highlighted in orange). Lastly, in some cases, the target address is first loaded into a register (highlighted in blue) and then jumped to via a register-based indirect jump (highlighted in pink).

Although functionally equivalent to normal jumps, the indirection&nbsp;complicates the control flow analysis in two ways. First,&nbsp;some of the indirect jump targets cannot be statically determined (for example, when the register holding the target address can be set in multiple different preceding basic blocks, each potentially loading a different target), leaving the control flow graph incomplete as the connections between basic blocks are lost. Second, some of these orphaned blocks end up being misidentified as standalone functions, further disrupting function boundary detection and leading to a broken, incomplete decompiler output. Notably, Figure 28 also provides another glimpse of the <code>nop</code> paddings discussed earlier.

Both binaries contain hundreds of these indirect dispatch points, and once again, if we set aside the minor differences arising from the 32-bit vs. 64-bit differences, the obfuscation is virtually identical. Although removing the obfuscation entirely requires more effort, the IDA’s decompiler output can be significantly improved by marking the referenced offsets as constants. For those interested, we covered this trick in our <a href="https://www.gendigital.com/blog/insights/research/defeating-aurastealer-obfuscation">AuraStealer blog post</a>, along with other approaches for tackling control flow obfuscation.<h2>What’s new in Remus</h2>Having covered the key similarities between Remus and Lumma, let’s now focus on what is new in Remus. The core architecture is clearly inherited from Lumma. Still, several changes go beyond a straightforward 32-bit-to-64-bit port. These range from refactored strings and more thorough device fingerprinting to a different exfiltration archive format, a switch from FNV-1a to CRC32 for API hashing, and an overhauled C2 communication that has been restructured to deliver dynamic configurations incrementally rather than in a single large blob. &nbsp;The most significant changes, however, are the replacement of traditional Steam/Telegram dead drop resolvers with blockchain-based C2 resolution using EtherHiding, a persistence technique allowing attackers to store malware-related data (such as domains, payloads, encryption keys, among others) on blockchain as a smart contract, and the introduction of additional anti-analysis checks.<h3>Dead drop resolvers via EtherHiding</h3>Both Remus and Lumma employ dead drop resolvers, a mechanism in which the malware does not contact its C2 server directly but instead retrieves the C2 address at runtime from an intermediary hosted on a legitimate platform. This makes the infrastructure significantly more resilient, as if a C2 domain is taken down, the dead drop can be adjusted to point to a new server without the need to distribute an updated binary. Moreover, the dead drop URLs typically reside on well-known, high-reputation services, making them more difficult for security vendors to block without collateral damage.Where the two differ is in the choice of platform. Lumma relies on Steam profiles and Telegram channels, typically encoding C2 URLs using ROT-15, while Remus goes a step further, replacing these with Ethereum smart contracts. At runtime, it sends an <code>eth_call</code> JSON-RPC request to a hardcoded contract address via a public RPC endpoint and extracts the C2 URL from the hex-encoded response. Because blockchain data is decentralized and immutable, there is no platform operator to report abuse to, making the dead-drop effectively immune to takedowns.Just like Lumma’s Steam profile URL, Remus stores the smart contract address separately from the static C2 configuration, as a stack-encrypted string. Notably, after the JSON response is retrieved, the C2 address is, at least for now, merely hex-encoded in the <code>result</code> field (no other obfuscation, such as ROT-15 in case of Lumma, is applied).

<h3>Additional anti-analysis checks</h3>Remus introduces two additional anti-analysis mechanisms, both evaluated early during startup (before connecting to its C2). If either check fails, the malware silently terminates via <code>ExitProcess(0)</code>.&nbsp;The first check targets sandbox and analysis tool DLLs. Remus walks the PEB's <code>InLoadOrderModuleList</code>, hashes the name of every loaded module using a CRC32 variant with a custom initialization constant, and compares the result against 11 pre-computed hashes stored in its <code>.rdata</code> section, each corresponding to a module commonly injected by analysis environments, including Avast sandbox (<code>snxhk.dll</code>), Sandboxie (<code>sbiedll.dll</code>), Comodo sandbox (<code>cmdvrt32.dll</code>, <code>cmdvrt64.dll</code>), and several others.&nbsp;

If no sandbox DLLs are detected, Remus proceeds by expanding the path&nbsp;<code>%UserProfile%\Documents\Outlook Files</code>, enumerating all&nbsp;<code>*.pst</code>&nbsp;files in that directory, and checking for the presence of&nbsp;<code>honey@pot.com.pst</code>, which would be treated as a sandbox environment.&nbsp;<h2>Summary</h2>In this analysis, we described our findings regarding a new x64 variant of Lumma Stealer, which we call Remus. We focused on various similarities and differences between Lumma and Remus, thoroughly describing the technical aspects of both. We also provided a timeline, referencing the very first test builds of Remus (historically called Tenzor), which correlate with the extensive doxxing of Lumma authors from late August to October 2025.The key aspects that allowed us to attribute Remus as a new x64 version of Lumma are the use of the same string obfuscation technique, AntiVM checks, direct syscall/sysenter handling, indirect control flow obfuscation, and, most importantly, an almost identical approach to bypassing AppBound Encryption, which we’ve only seen used by Lumma to date.Remus, however, is not merely an x64 port of Lumma. It also introduces a couple of novel techniques in how it operates, including the use of EtherHiding instead of a traditional approach of using Steam/Telegram as dead drop resolvers, as well as additional anti-analysis checks to evade a wider range of security vendors.<h2>Indicators of Compromise (IoCs)</h2>A complete IoC list is available on our <a href="https://github.com/gendigitalinc/ioc/tree/master/Remus">GitHub</a>.<h3>C2 domains</h3>hxxp[://]217[.]156[.]122[.]12:80 hxxp[://]217[.]156[.]122[.]57:80 hxxp[://]217[.]156[.]122[.]75:1378 hxxp[://]45[.]151[.]106[.]110:80 hxxp[://]80[.]97[.]160[.]155:80 hxxp[://]86[.]107[.]168[.]103:80 hxxp[://]94[.]231[.]205[.]229:28313 hxxp[://]adveryx[.]biz:6573 hxxp[://]backbou[.]biz:5902 hxxp[://]baxe[.]pics hxxp[://]baxe[.]pics:48261 hxxp[://]borscer[.]biz:9592 hxxp[://]buccstanor[.]pics hxxp[://]buccstanor[.]pics:28313 hxxp[://]buccstanor[.]pics:48261 hxxp[://]chalx[.]live:5902 hxxp[://]chromap[.]biz:4219 hxxp[://]coox[.]live:28313 hxxp[://]drymoge[.]biz:4192 hxxp[://]forestoaker[.]com:6290 hxxp[://]gluckcreek[.]online:48261 hxxp[://]intem[.]lat:9592 hxxp[://]interxo[.]biz:7481 hxxp[://]josegza[.]biz:8521 hxxp[://]krondez[.]com:28982 hxxp[://]lazzo[.]bet:3989 hxxp[://]managew[.]biz:5902 hxxp[://]navelum[.]biz:3201 hxxp[://]nitroca[.]biz:6782 hxxp[://]outcrol[.]biz:4895 hxxp[://]padaz[.]pics:4219 hxxp[://]parky[.]pics:3989 hxxp[://]prickaz[.]biz:2039 hxxp[://]remnane[.]biz:5692 hxxp[://]ropea[.]top:28313 hxxp[://]siltsoh[.]biz:7481 hxxp[://]texakgi[.]cloud:3849 hxxp[://]vinte[.]online hxxp[://]vinte[.]online:28313 hxxp[://]woodena[.]biz:7821 hxxp[://]zadno[.]run:4219 hxxps[://]cheekiez[.]biz hxxps[://]nobleckly[.]biz&nbsp;<h3>Remus SHA-256 (Non-exhaustive)</h3>0a8f734f10400f7ae8fef591147e78dab6350089683be84c1cb6c82113cb1319 25e74a76f2f3601abcb20fd743a7e3cf3befd5a3838c7501af5d87d293233809 4428c3ffe2532f162f31d7573bbc1cca2299195421da3d8e8a3e535e9fc42b08 484e3ab5d425a97819f01dcc330e005dc444c51625bfdcd7ea9a3954018d1fc9 64db10e76b46be8db36e02993d36559bc3f86606c9ea955731872b716c8f0c69 788b56e9be2f1dd6a977dce0265f293ab42d3e8ffb287ab584e169fbf115da1f 8653d7158486aa10fc0078c3ca9318cd7ace05d4b3e6f3b1fb84ffb7a6a339ec a4f111e5425690fcd384c62ecb5b57b0f645925572af3541748e01d810cd2b40 ab2e47720388fa201e242552f8d8b82363c6c52f6c63fa3fec9dce027cb12e77 bc11d036fe59abb3915f736307c56d2fd43e8127e46c31f926eeda864f4d66dc c3f7cea80dbafaa90a88b28a6dfb1227caaf5c2a29f0ce06bf663d6ed2cfc079&nbsp;<h3>Tenzor SHA-256&nbsp;</h3>0580ebf601989457f0708799b431fd4d9f5e59d98838282d72936099aa6636da 7a25253e6d8d9ccf62a67f8014cacb301daf9e40f1b68ecc7f354d6896d16960 cab7855ccfca19a06eea76e0e170f592dcc95906ecfa5436f5a11947e04e63d5 dfbeab30d14df9104a95de83ab4690308c653eb0c3706554687c45a77adc1385

The Lumma Rebrand We’ve Been Waiting For?

Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer

<h2>Key Points&nbsp;</h2><ul type="disc"><li data-list-item-id="e59deb5ed92385418b6c648bee2751bf3">VoidStealer is the first infostealer observed in the wild adopting a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the <code>v20_master_key</code> directly from browser memory.&nbsp;</li><li data-list-item-id="ee23cdbf8bdc0aabe684c5884f164ed93">The bypass requires neither privilege escalation nor code injection, making it a stealthier approach compared to alternative ABE bypass methods.&nbsp;</li><li data-list-item-id="e9aad20d0fd1b9a44cdb3bdc4c74ad104">In this technical blog post, we dissect the bypass technique step-by-step, from locating the target address for breakpoint placement to extracting the <code>v20_master_key</code>.&nbsp;</li><li data-list-item-id="e1808ce54ff39fc88832d5379553d4e3b">To support the defense community, Gen Threat Labs provides practical detection strategies and indicators to help defenders identify and mitigate this novel bypass technique.&nbsp;</li></ul><h2>Introduction&nbsp;</h2>When Google introduced <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">Application-Bound Encryption</a> (ABE) in July 2024 with Chrome 127, it didn't mark the end of infostealers –⁠⁠⁠⁠⁠⁠ as expected, infostealers adopted quickly and came up with various methods to bypass it. Still, it undoubtedly raised the bar for accessing sensitive browser data, and, more importantly, significantly increased the visibility of such data theft attempts, as bypassing ABE now requires attackers to perform additional steps that are inherently more suspicious. Various bypass techniques have emerged since then, and since each comes with its own trade-offs, new approaches continue to appear as threat actors seek to minimize the footprint and evade detection.&nbsp;In this technical blog post, we dissect a novel debugger-based ABE-bypass technique that is both technically elegant and offers a significant advantage over other existing bypass methods: a much lower detection footprint. The technique relies on attaching to the browser process as a debugger and setting breakpoints at carefully selected locations to extract the <code>v20_master_key</code> directly from the browser process memory. We demonstrate the technique on VoidStealer, the first emerging infostealer we have observed using this approach in the wild.&nbsp;&nbsp;<h2>VoidStealer&nbsp;</h2>VoidStealer is a MaaS infostealer that began being marketed on several darkweb forums since mid December 2025 and has been actively developed since then.&nbsp;

Considering the first version of VoidStealer from December 12, 2025, as the earliest date we have identified it being offered, the VoidStealer development timeline is approximately as follows (please note that exact dates may vary slightly, as we rely on announcements made by the malware developers themselves on HackForums):&nbsp;

<table class="table"><tbody><tr><td>VoidStealer version</td><td>Release Date</td></tr><tr><td>v1.0</td><td>Dec 12, 2025&nbsp;</td></tr><tr><td>v1.1&nbsp;</td><td>Jan 16, 2026&nbsp;</td></tr><tr><td>v1.2&nbsp;</td><td>Jan 19, 2026&nbsp;</td></tr><tr><td>v1.3&nbsp;</td><td>Feb 3, 2026&nbsp;</td></tr><tr><td>v1.4&nbsp;</td><td>Feb 4, 2026&nbsp;</td></tr><tr><td>v1.5&nbsp;</td><td>Feb 22, 2026&nbsp;</td></tr><tr><td>v1.6&nbsp;</td><td>Mar 3, 2026&nbsp;</td></tr><tr><td>v1.7&nbsp;</td><td>Mar 9, 2026&nbsp;</td></tr><tr><td>v1.8&nbsp;</td><td>Mar 10, 2026&nbsp;</td></tr><tr><td>v1.9&nbsp;</td><td>Mar 10, 2026&nbsp;</td></tr><tr><td>v2.0&nbsp;</td><td>Mar 13, 2026&nbsp;</td></tr><tr><td>v2.1&nbsp;</td><td>Mar 18, 2026&nbsp;</td></tr></tbody></table>&nbsp;

The version 2.0, reported on Mar 13, 2026, introduced the novel ABE bypass technique.&nbsp;

To keep the blog post to the point, we focus mainly on the bypass technique itself rather than VoidStealer's capabilities.&nbsp;<h2>ABE Bypass(es)&nbsp;</h2>Similarly to other infostealers, VoidStealer does not rely on a single ABE-bypass technique but implements two distinct methods in case one fails. The first is a well-documented approach that involves injecting into the browser process and invoking <code>IElevator::DecryptData</code> from the browser's context via the COM interface. Since this is a well-known and thoroughly documented technique, we will not detail it here (for those interested, it is extensively documented in the <a href="https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption" target="_blank" rel="noreferrer noopener">ChromElevator project</a>). Nevertheless, it is worth noting that, however reliable it is, this technique relies on process injection, which is noisy and suspicious and might easily get flagged by security tools. The second (novel) approach is stealthier in this regard – it relies solely on the WinAPI function <code>ReadProcessMemory</code> and debugger attachment, which are considerably less suspicious than direct browser memory injection.&nbsp;To clarify how the bypass operates and what it exploits, let's take a step back and briefly recap what the idea behind Application-Bound Encryption is and how Chrome uses it to protect passwords and other sensitive data. Chrome passwords are encrypted and stored in a SQLite3 database located at <code>%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data</code> (assuming standard Chrome installation on Windows) and can be accessed, for example, by running the following Python script:&nbsp;

The script output for a single record would look roughly as follows (note the <code>v20</code> prefix in the encrypted password, indicating ABE-protected data):&nbsp;

The password value is encrypted using AES-GCM with the <code>app_bound_key</code>, which we will refer to as the <code>v20_master_key</code> going forward. The decryption process begins by removing the <code>v20</code> prefix from the encrypted string, then extracting the following 12 bytes to use as the nonce, and finally treating the remaining data as the combined ciphertext and authentication tag. Below is a simple Python script demonstrating this decryption process:&nbsp;

At this point, it is crucial to highlight that the knowledge of the <code>v20_master_key</code> is sufficient for decrypting any ABE-protected data tied to the application (in this case, Chrome). Where does this key come from, though? Chrome stores it in an encrypted form on disk in a JSON file <code>%LOCALAPPDATA%\Google\Chrome\User Data\Local State</code> under the <code>["os_crypt"]["app_bound_encrypted_key"]</code> field. Extracting the actual key in unencrypted form (<code>v20_master_key</code>) requires base64-decoding the value, removing the <code>APPB</code> prefix, calling <code>CryptUnprotectData</code> as <code>NT AUTHORITY\SYSTEM</code>, then calling it again as the logged-in user, and finally, specifically for Chrome, performing additional post-processing that we will not cover in detail here (for those interested, see the <a href="https://github.com/chromium/chromium/blob/main/chrome/elevation_service/elevator.cc#L229-L239" target="_blank" rel="noreferrer noopener">Chromium source code</a>). The ABE-protected password decryption workflow is illustrated in Figure 7.&nbsp;

To summarize, the fundamental security mechanism behind ABE lies in that the <code>v20_master_key</code>, which is used to encrypt/decrypt the sensitive browser data, is protected by <code>CryptProtectData</code> invoked as <code>NT AUTHORITY\SYSTEM</code>, the highest-privileged account on Windows.&nbsp;&nbsp;Chrome, however, runs in the context of the logged-on user, not as <code>SYSTEM</code>. So how does it decrypt the key? To bridge that gap, Google implemented a separate service, Google Chrome Elevation Service (<code>elevation_service.exe</code>), which runs with <code>SYSTEM</code> privileges and handles the decryption. When Chrome needs to decrypt the <code>app_bound_encrypted_key</code>, it invokes <code>IElevator::Decrypt()</code> via a COM interface. The elevation service "validates" that the caller is Chrome, and if the check passes, returns the decrypted <code>v20_master_key</code> (the word validates is quoted as the check is not particularly robust and opens the door to another bypass). Chrome can then use the <code>v20_master_key</code> to encrypt or decrypt sensitive data such as cookies and passwords.&nbsp;

It is obvious that if the malware managed to run as <code>NT AUTHORITY\SYSTEM</code>, it could simply replicate all the steps and directly decrypt the <code>app_bound_encrypted_key</code> (and that is also one of the ABE bypass techniques). However, such a bypass still requires SYSTEM-level privileges, limiting its applicability to only some environments. Therefore, infostealers typically use it as a complementary method when other approaches fail, rather than relying on it as their primary technique.&nbsp;&nbsp;There is also the option of injecting into Chrome and making the key decryption request directly from within the context of the browser, a commonly used bypass technique that VoidStealer itself employs. While this approach avoids the need for <code>SYSTEM</code> privileges, it still requires the injection, which is noisy.&nbsp;&nbsp;&nbsp;This perfectly illustrates our earlier point – ABE does not prevent data theft, but it undoubtedly forces attackers into more visible actions, thus introducing great detection/hunting opportunities for us, defenders.&nbsp;&nbsp;What prevents infostealers from reading the <code>v20_master_key</code> directly from the browser's memory, though? Chrome implements several protective measures to prevent it. First, the key is retained in memory in plaintext only for the minimum duration required to complete the cryptographic operation, minimizing its exposure. Additionally, the key is encrypted using the <code>CryptProtectMemory</code> function with the <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code> flag, ensuring that even if an attacker could read the encrypted form of the key from memory, they would still need to invoke the complementary decryption function, <code>CryptUnprotectMemory</code>, directly from the Chrome process to decrypt it. And that would require a code injection, which is noisy.&nbsp;&nbsp;Nevertheless, despite these safeguards, there is still a critical weakness. Regardless of how small the key exposure window is, there is still a moment in which the <code>v20_master_key</code> is present in memory in plaintext. And that is precisely what the novel technique exploits. By attaching to the browser process as a debugger and setting a breakpoint at the precise moment when the key is present in plaintext, an attacker can extract it directly from the memory. Importantly, this can be done without any privilege escalation and, when using hardware breakpoints rather than software ones, without any writes to the browser process.&nbsp;Note that the VoidStealer developers did not invent the technique. They directly adopted it from the open-source <a href="https://github.com/Meckazin/ChromeKatz/tree/main/ElevationKatz" target="_blank" rel="noreferrer noopener">ElevationKatz</a> project, developed by Meckazin, the same author behind CookieKatz and CredentialKatz, which were among the first tools capable of bypassing ABE since its introduction. Although there are some differences, based on our analysis, it is evident that VoidStealer's implementation is directly based on ElevationKatz, which has now been public for over half a year. Yet, VoidStealer is the first malware we are aware of employing this technique in the wild.&nbsp;In the following section, we focus specifically on VoidStealer's implementation of the bypass.&nbsp;<h2>Technical Walkthrough of VoidStealer's Implementation of the Novel ABE Bypass&nbsp;</h2>&nbsp; The success of the entire technique boils down to finding the right address on which to set the breakpoint. VoidStealer begins by spawning a browser process via <code>CreateProcessW</code> with the <code>CREATE_SUSPENDED</code> and <code>SW_HIDE</code> flags. It then resumes the main thread and immediately attaches a debugger to the newly spawned process via <code>DebugActiveProcess</code>.&nbsp;&nbsp;While it may not be immediately obvious, beginning with this step is deliberate and strategically important as browsers typically load cookies into memory during startup. And since the cookies are ABE-protected, the browser must decrypt the <code>v20_master_key</code> during its initialization. This makes the browser startup an ideal opportunity to intercept and steal the key.&nbsp;

It is unclear to us why VoidStealer launches the browser in a suspended state (an additional suspicious indicator), only to resume and attach a debugger immediately afterward, rather than directly spawning the browser under a debugger. Nevertheless, we have verified that the same bypass technique works equally well when the browser is spawned directly using <code>CreateProcessW</code> with the <code>DEBUG_ONLY_THIS_PROCESS</code> flag. We assume that this is simply a consequence of copy-pasting the code from ElevationKatz, which follows the same approach.&nbsp;Once attached as a debugger, VoidStealer begins listening for debug events via <code>WaitForDebugEvent</code>.&nbsp;

Since VoidStealer targets only Chrome and Edge (like ElevationKatz), the code address the bypass tries to find resides in either <code>chrome.dll</code> or <code>msedge.dll</code> (though it could readily be extended to other Chromium-based browsers). Because VoidStealer attaches to the browser as a debugger almost immediately after launch,&nbsp;before all DLLs have been loaded, it cannot simply search for the target module right away. Instead, it waits for <code>LOAD_DLL_DEBUG_EVENT</code> (sent to the debugger whenever a new DLL is loaded into the debugged process memory) and checks each loaded module against the target DLL.&nbsp;

Once the target DLL is loaded, VoidStealer scans its entire <code>.rdata</code> section using <code>ReadProcessMemory</code> to find the string <code>OSCrypt.AppBoundProvider.Decrypt.ResultCode</code>, or more precisely, its address.&nbsp;

A good question is: why this particular string? The answer lies in the <a href="https://github.com/chromium/chromium/blob/2852519ad41d6809df1786b3854fe5055b364687/chrome/browser/os_crypt/app_bound_encryption_provider_win.cc#L137" target="_blank">Chromium source code</a>, which reveals that this string appears immediately after the call to <code>os_crypt::DecryptAppBoundString</code>. Thus, this is precisely the point at which the <code>v20_master_key</code> is present in the browser's memory in plaintext.&nbsp;&nbsp;

Furthermore, there is only one cross-reference to that string, making it a perfect target for the breakpoint.&nbsp;

Following the cross-reference in <code>chrome.dll</code>, we can see that the disassembled code corresponds to the source code and that the cross-reference comes from a <code>LEA</code> instruction.&nbsp;

The important bytes from the <code>LEA</code> instructions are the last four, as they specify the 32-bit displacement used to calculate the actual address, which is to be loaded into the <code>RCX</code> register.&nbsp;&nbsp;

The CPU essentially calculates the address as follows: <code>RCX = (instruction_address + 7) + (signed int32) disp32</code>. To find the <code>LEA</code> instruction referencing the target string, VoidStealer scans the whole <code>.text</code> section and searches for the byte sequences <code>48 8D 0D</code> (the beginning of the <code>LEA</code> instruction), extracts the following 4 bytes (the 32-bit displacement), and calculates the referenced address. It then compares each calculated address against the <code>OSCrypt.AppBoundProvider.Decrypt.ResultCode</code> string address to identify the matching <code>LEA</code> instruction referencing it, which becomes the target address for the breakpoint.&nbsp;

If the search is successful, VoidStealer sets a hardware breakpoint at this address across all browser threads by resolving <code>NtGetNextThread</code> from <code>ntdll.dll</code> and iterates through each thread, suspends it, writes the breakpoint address into <code>DR0</code>, enables it via <code>DR7</code>, and resumes the execution.&nbsp;

To ensure complete coverage, VoidStealer’s debug loop also handles <code>CREATE_THREAD_DEBUG_EVENT</code> events to set up the hardware breakpoint for any newly created thread.&nbsp;

At this point, it might be worth explaining why hardware breakpoints are chosen over software ones. Setting a software breakpoint requires patching the binary by overwriting the target address with, for example, an <code>INT3 (0xCC)</code> instruction, necessitating a memory write into the browser’s memory. And that is precisely what attackers aim to avoid. Hardware breakpoints, on the other hand, can be configured entirely through <code>SetThreadContext</code> without ever modifying the browser’s memory, making the bypass stealthier.&nbsp;&nbsp;Once the breakpoints are in place, all that is left is to wait for them to trigger. Since cookies are protected by ABE and the browser needs to load them at startup, it must request the <code>v20_master_key</code> decryption shortly after launching to decrypt them from disk. Therefore, there is a high chance that the breakpoint will be triggered shortly after the browser starts.&nbsp;

If the breakpoint is placed on the <code>LEA RCX</code>, <code>OSCrypt.AppBoundProvider.Decrypt.ResultCode</code> address, then in current builds, the <code>R14</code> register (for Edge) or <code>R15</code> register (for Chrome) holds a pointer to the <code>v20_master_key</code>. From there extracting the key straight from the memory is only two <code>ReadProcessMemory</code> calls away.&nbsp;&nbsp;To make it easier to grasp the big picture of the entire bypass, we have illustrated the complete workflow in Figure 23.&nbsp;

<h2>Detection Strategies for Defenders&nbsp;</h2>We should first emphasize that different malware authors will likely adapt the bypass technique in various ways – for example, they may not target the <code>v20_master_key</code> usage immediately after startup (in which case they could leverage an already-running browser instance). For detection purposes, it is crucial to identify what is unlikely to change across all possible variations. Regardless of implementation details, the bypass fundamentally relies on setting hardware breakpoints at strategic locations, which requires either attaching a debugger or launching the browser under a debugger, along with browser memory reads.&nbsp;&nbsp;&nbsp;&nbsp;These invariants provide strong detection opportunities, especially in sandboxed environments, as legitimate applications do not debug browsers. What about legitimate debuggers, though? Even those require users to explicitly specify which application to debug. Therefore, if an application starts debugging a browser autonomously, it should be a clear red flag.&nbsp;&nbsp;&nbsp;&nbsp;But beyond that, there are other detection opportunities. While reading browser memory may seem less suspicious than writing to it, as this bypass demonstrates, it actually can be. Therefore, monitoring reads from browser memory can provide valuable detection signals, as benign applications rarely have legitimate reasons to access it.&nbsp;&nbsp;Lastly, the technique requires a running browser instance, which malware will typically try to hide from the user. Whether by launching it via <code>CreateProcess</code> with the <code>SW_HIDE</code> flag, running it in headless mode, creating a new desktop and running it from there, or positioning the browser window off-screen. These evasion tactics can serve as additional indicators of such malicious activity.&nbsp;<h2>Summary&nbsp;&nbsp;</h2>VoidStealer is the first infostealer observed in the wild employing a debugger-based ABE bypass technique (directly adapted from the publicly available ElevationKatz project), highlighting the continuously evolving landscape of Application-Bound Encryption bypasses. Unlike traditional bypass methods, it requires neither privilege escalation nor code injection, making it a stealthier alternative.&nbsp;&nbsp;Given these advantages, combined with the availability of a public PoC (ElevationKatz), it is only to be expected that more infostealers will adopt the bypass technique in the future.&nbsp;<h2>IoC&nbsp;</h2>f783fde5cf7930e4b3054393efadd3675b505cbef8e9d7ae58aa35b435adeea4 (VoidStealer v2.0)&nbsp;

A Novel Debugger-based ABE Bypass Spotted in the Wild

VoidStealer: Debugging Chrome to Steal Its Secrets 

<h2>Key points</h2><ul><li data-list-item-id="efa2702de580247f6397d254301188d2c">AuraStealer is an emerging malware-as-a-service (MaaS) infostealer observed in recent Scam-Yourself campaigns.</li><li data-list-item-id="ece552b6979ea0952bbe94abad912ebef">To hinder both static and dynamic analysis, AuraStealer employs a wide range of anti-analysis and obfuscation techniques, including indirect control flow obfuscation and exception-driven API hashing.</li><li data-list-item-id="e35d31d421cc5db86bac17645f30515a2">In this technical blog post, we provide a deep dive into the malware’s execution flow and functionality and provide practical tips and workflows for defeating its obfuscation.</li><li data-list-item-id="edc17181ba17c41a7dc5f94a739ae72cf">To support the defense community, Gen Threat Labs provides multiple scripts to assist defenders in analyzing AuraStealer, including a string decryption script and a dedicated configuration extractor.</li></ul><h2>Introduction</h2>AuraStealer is a rapidly growing infostealer-as-a-service, actively promoted across multiple underground forums since July 2025. The stealer is developed in C++ with a build size of ~500-700 kB and targets Windows systems from Windows 7 to Windows 11. It is marketed as a supposedly highly efficient, low-footprint stealer capable of stealing data from more than 110 browsers, 70 applications (including wallets and 2FA tools), as well as over 250 browser extensions, with the ability to further expand its collection scope through a customizable configuration. Contrary to the advertised claims, AuraStealer still contains multiple flaws that undermine its stealth and evasion capabilities, offering clear detection opportunities for defenders.

The infostealer is offered through a tiered subscription model, with the Basic plan priced at $295/month and the Advanced plan at $585/month. The tiers differ primarily in terms of configuration flexibility, data filtering, and operational scalability. A third tier, Team plan, is currently under development and is expected to introduce features tailored for collaborative use. Additionally, a temporary Trial tier was also offered, priced at $165 for a two-week subscription, which included all the features of the Basic plan. The Trial tier was available for purchase only during a 30-day window, aiming to attract new users before they committed to a full subscription.The subscriptions include access to a dedicated web panel for managing and viewing stolen data, built on the Tabler template. Given that both the panel and the stealer were originally offered exclusively in Russian, it is reasonable to assume the developers operate within Russian‑speaking cybercriminal communities. However, this does not necessarily indicate their precise origin. The panel has since been updated and now supports both Russian and English.

<h2>Landscape</h2>AuraStealer primarily spreads through Scam-Yourself campaigns, with&nbsp;<a href="https://undercodenews.com/tiktoks-dark-trick-aura-stealer-malware-masquerades-as-product-activation-guides/" target="_blank">TikTok videos</a> disguised as product activation guides being one of them. In these videos, victims are lured by an apparently easy tutorial promising free activation of otherwise paid software. Viewers are instructed to manually retype and run a displayed command in an administrative PowerShell, which, however, instead of activating the software, quietly downloads and executes the malicious payload. Concrete examples of these videos, along with the full execution chain and additional IoCs, can be found&nbsp;<a href="https://isc.sans.edu/diary/32380" target="_blank">here</a>.&nbsp;Apart from TikTok Scam-Yourself campaigns, AuraStealer is also distributed through supposedly cracked games or software, with delivery chains of varying complexity. In the simplest cases, only a UPX-packed version of AuraStealer is executed, without additional stages, whereas the more elaborate campaigns employ multi-stage execution flows, involving custom loaders, DLL sideloading, injection into legitimate processes, or other intermediary steps. We have also observed AuraStealer being delivered together with GlassWorm via a malicious VS Code extension. Taken together, these observations indicate that AuraStealer is sold purely as the stealer itself, without a loader layer or additional delivery mechanisms.Determining the exact scope of the AuraStealer threat is challenging, as we often block its delivery chains at earlier stages before the final payload can be executed. While the proactive defense is crucial for keeping our users safe, it also results in many AuraStealer payloads never reaching the system. As a result, it becomes inherently difficult not only to observe and quantify the full scope of the threat, but also to determine with certainty whether the blocked payloads were indeed intended to deliver AuraStealer.Should it, for example, be delivered through ClickFix, one of the most widely adopted delivery techniques lately, we would proactively defend against those attacks right at the clipboard stage with our&nbsp;<a href="https://www.gendigital.com/blog/news/family-of-brands/clipboard-protection" target="_blank">Clipboard protection</a> feature. ClickFix typically refers to a technique in which users are presented with artificially generated errors or problems that must be resolved to continue, while simultaneously being provided with step-by-step instructions to address the issue. The steps usually include copying a command and running it via the Windows Run dialog or another system prompt, which, however, rather than resolving the issue, silently retrieves and executes the malicious payload.To summarize, AuraStealer is not yet as widespread and popular as the more established infostealer families currently dominating the threat landscape, such as Lumma Stealer, StealC or Vidar. However, according to an&nbsp;<a href="https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-aura-9b513369e117" target="_blank">interview</a> conducted by&nbsp;<a href="https://x.com/g0njxa" target="_blank">g0njxa</a> with the AuraStealer developers, the malware is backed by a committed team that continuously improves and evolves its functionality, aiming to become the number one in the infostealer market. This suggests that AuraStealer could become a more significant player in the future.<h2>AuraStealer Obfuscation</h2>AuraStealer incorporates a wide range of techniques designed to hinder both static and dynamic analysis. These include control flow obfuscation, string encryption, constant obfuscation, as well as standard anti-debug, anti-tamper, and anti-VM checks. It further employs advanced techniques such as exception-driven API-hashing, leveraging the Heaven’s Gate for suspicious NTDLL calls, and performing checks to detect breakpoints on return addresses.<h3>Indirect Control Flow Obfuscation</h3>The first obfuscation technique an analyst is likely to encounter when opening AuraStealer in a disassembler, such as IDA Pro, is its indirect control flow obfuscation. The obfuscation is not only immediately noticeable, but also one of the most troublesome obstacles that must be overcome to properly analyze the stealer. The obfuscation is based on systematically replacing direct jumps and calls with indirect ones, where the actual target address is computed only at runtime. This method effectively disrupts static analysis, as the disassemblers are left with a set of seemingly unrelated basic blocks, effectively breaking any control-flow graph analysis or decompilation.&nbsp;To demonstrate how this obfuscation works in practice, and how it can be defeated, we focus on the&nbsp;<code>WinMain</code> function, which is both the longest and the most complex function of the stealer. Several examples illustrating the obfuscation mechanism at the assembly level are shown in Figure 4 below, with the instructions relevant to computing each target address highlighted in a distinct color. Notably, the screenshot also illustrates that the obfuscation successfully confused IDA, causing it to misinterpret the entire&nbsp;<code>WinMain</code>&nbsp;function as a single basic block.

As illustrated, the target addresses are computed in several different ways depending on the branching context, ranging from simple arithmetic sum of two values (highlighted in green, blue, and red) to more complex ones, where the resulting target address may take multiple possible forms, with the final choice determined by a conditional instruction such as <code>cmovz</code>&nbsp;(highlighted in pink).At that point, a reader could easily conclude that a bit of pattern matching, emulation, and patching would be enough to remove the obfuscation – and that was our initial assumption as well. However, it turned out that AuraStealer uses multiple variations of these indirect control flow obfuscation schemes, some of which employ far more elaborate patterns. For example, the target address may even depend on the return values of multiple preceding function calls, since its computation involves conditional instructions driven by those results (see Figure 5).&nbsp;

Nonetheless, despite the diversity and potential complexity of these obfuscation schemes, there are still ways to deal with them and reconstruct the original control flow. First, the most basic scheme used to obfuscate function calls, which relies solely on the sum of two values can be resolved with a simple trick in IDA Pro. In these cases, it is sufficient to hint to IDA that the offsets contributing to the sum operation are in fact constant. Once treated as constant operands, IDA can evaluate the arithmetic on its own and optimize it accordingly, allowing the decompiler to reveal the actual call’s target address.

Figures 7 and 8 illustrate the effect of this trick and the resulting difference in the decompiled output. As can be seen, even such a minor adjustment can substantially improve the analysis, as it replaces these otherwise meaningless offset sum calculations with direct references to the actual target functions.&nbsp;

Since these offset references often appear in consecutive blocks (Figure 9), it is practical to automate their processing, for which the IDA Python snippet shown in Figure 10 is particularly useful.&nbsp;

Unfortunately, this trick alone is insufficient to address the conditional jumps and other schemes of AuraStealer's indirect control flow obfuscation. Nonetheless, given how many calls are obfuscated with this simple scheme, applying it still provides meaningful progress and can serve as a solid starting point for further deobfuscation. Moreover, AuraStealer applies the same obfuscation scheme to hide certain function arguments as well, making it applicable for those cases as well.&nbsp;To tackle the more sophisticated patterns, backward slicing proved to be the most effective approach. For those interested in a more detailed explanation of how this technique works, the articles <a href="https://cloud.google.com/blog/topics/threat-intelligence/lummac2-obfuscation-through-indirect-control-flow" target="_blank">LummaC2: Obfuscation Through Indirect Control Flow</a> by Nino Isakovic and Chuong Dong, and <a href="https://cyber.wtf/2025/11/19/rhadamanthys-loader-deobfuscation/" target="_blank">Rhadamanthys Loader Deobfuscation</a> by Melissa Eckardt provide excellent explanations and are definitely worth reading.&nbsp;In short, backward slicing is a program analysis technique that identifies instructions that may influence a specific register or memory address at a specific program point by following data and control dependencies. The resulting set of instructions (also referred to as “slice”) can then be used for further analysis, such as emulation or symbolic execution, to recover the value of the targeted register or memory location.In our case, we employed a heuristic heavily inspired by backward slicing but simplified and tailored specifically for AuraStealer. The heuristic can be summarized in the following steps:<ol><li data-list-item-id="ecd3253d0603374eaf8d20dd66172b91d">Locate the indirect <code>jmp/call</code> instruction.</li><li data-list-item-id="e7b880facf92a03037d90860f993fcb36">Add the register used as the target operand of this indirect <code>jmp/call</code> instruction to the <code>tracked_regs</code>&nbsp;set.</li><li data-list-item-id="ec092ae366c82f77e5499781619650e26">Iterate through instructions in reverse (from the indirect <code>jmp/call</code> towards lower addresses), analyzing each instruction whether it affects any of the tracked registers.<ol><li data-list-item-id="e40093d39d8dbbc2cec042d383218e369">If an instruction modifies a tracked register, mark it as relevant.</li><li data-list-item-id="e85efd9ec51801adf2201c1174b60bc36">For a relevant instruction, determine if it completely overwrites a tracked register (e.g., <code>MOV reg, imm</code>, <code>XOR reg, reg</code>,&nbsp;etc.), and if so, remove that register from <code>tracked_reg</code>, ending its dependency chain.</li><li data-list-item-id="e6dacf6f0c3c4ec55bc5360ef989126fa">Otherwise, identify all source registers of that relevant instruction and add them to the <code>tracked_reg</code>&nbsp;set to propagate the dependency further back.</li></ol></li><li data-list-item-id="e83fa1ba035c370537e28dcd5d09a12fe">Stop the process if any of these conditions occur:<ol><li data-list-item-id="e5c6a6b0ded1afb1454ccfef52dbad329">The <code>tracked_regs</code>&nbsp;set is empty (all dependencies have been resolved).</li><li data-list-item-id="efc5e5e4260697b4e98da073e4bbbf2dc">A control-flow instruction is encountered (<code>call</code>, <code>jmp</code>, <code>ret</code>), indicating a basic block boundary.</li><li data-list-item-id="e609dc4e0defe8e4c288899b3140d9e72">A maximum instruction limit is reached (fail-safe).</li></ol></li><li data-list-item-id="e191479030aa8e4a2fea1ead5fb74aaab">Finally, return the address of the earliest (lowest address) relevant instruction found, marking the start of the slice.</li></ol>For clarity, this heuristic is not meant to implement complete backward slicing. It deliberately omits memory‑write tracking and focuses solely on register flows. However, it is important to note that this limitation is intentional, as register-level analysis is sufficient for the deobfuscation of the indirect control flow obfuscation employed by AuraStealer. We use the heuristic solely to identify the slice’s starting address, from which we then perform symbolic execution with Angr to compute the target address(es). That said, if AuraStealer’s obfuscation were to change, the heuristic could be readily extended to also account for memory interactions.The reason we chose symbolic execution over emulation is that symbolic execution is inherently designed to explore all possible execution paths, making it easier to implement. In terms of computational requirements, it remains feasible since we only symbolically execute small code chunks.Attentive readers may have noticed that this approach has a minor imperfection. The heuristic terminates upon encountering a <code>call</code> instruction. However, as shown in Figure 5, the target address of some <code>jmps</code> can depend on the results of previous function calls, which may lead to an incorrectly identified slice start. To handle such cases, whenever a register is unconstrained, we assign it a symbolic boolean value (0 or 1), under the assumption that any function influencing such jumps returns a boolean value. Such cases, however, are relatively rare.&nbsp;The whole process can be automated with a bit of scripting and the recovered target addresses can be pushed back into IDA as comments, which already gives a good baseline for navigating the code.&nbsp;

However, we can go further – our real goal is to make IDA reconstruct the original control flow graph, not just annotate it. Once the target addresses of the indirect <code>jmps/calls</code> are retrieved, there are several ways to proceed. One option would be to patch the binary. However, due to the variability of the patterns involved and the presence of an anti‑tamper protection in AuraStealer, we have opted for a different approach.&nbsp;Instead of patching the binary, which is destructive and easily detectable by malware, we leveraged the IDA SDK to hook directly into the instruction analysis process. The idea is simple – rather than letting IDA analyze the instructions on its own, we intervene in the analysis process and modify how the instructions are decoded. For this purpose, IDA provides <a href="https://cpp.docs.hex-rays.com/structpost__event__visitor__t.html" target="_blank"><code>post_event_visitor_t</code></a>, a class that allows listening and reacting to specific events in IDA by overriding the virtual function <code>handle_post_event</code>.&nbsp;

Among all the possible event codes, the interesting one is the <code>processor_t::ev_ana_insn</code>&nbsp;(analyze instruction), which is triggered right after IDA calls the processor module’s instruction decoder, but before the resulting <code>insn_t</code> structure is finalized and committed to the database. At that point, we can inspect, or even modify, the decoded instruction. In other words, we can alter IDA’s perception of the code without ever touching the underlying binary.At this point, several observations are worth highlighting:<ul><li data-list-item-id="e9716e59925daa3e95f26cbf1ac5d78db">The indirect calls almost always have a single target.</li><li data-list-item-id="e3dffdbde351ed5c51120005ea6540ddf">Many conditional jumps have only two targets, one of which is the immediately following instruction.</li></ul>Resolving the indirect call obfuscation is therefore straightforward. Whenever we intercept the <code>processor_t::ev_ana_insn</code> event, we check whether the analyzed instruction is an indirect call (<code>call reg</code>). If the target address is known and it is the only possible target, we replace the <code>call reg</code> instruction with <code>call &lt;calculated_target_address&gt;</code>.For indirect conditional jumps, it would, in principle, be possible to determine the exact branch type by analyzing the conditional move used to compute the target address and replacing the <code>jmp</code> instruction with the corresponding conditional jump instruction. However, we opted for a much simpler and more pragmatic strategy. Many of these indirect jumps are, in fact, only obfuscated loops or <code>if-then/if-then-else</code> constructs with one of the target address pointing to the immediately following instruction. So, whenever we encounter an indirect <code>jmp</code> instruction with precisely two possible targets, one of which is the fall-through address, we replace the <code>jmp</code> instruction with <code>jnz</code> (jump if not zero) pointing to the non-fall-through target address.This transformation does not yield a perfectly accurate decompilation. However, if we accept the fact that some comparisons may appear as&nbsp;<code>condition != 0</code> rather than their exact form, we end up with a control flow that is already much easier to follow. Moreover, whenever the precise condition semantics matter, the original condition can always be examined directly in the disassembly. Although it would be possible to reconstruct and substitute the exact conditional jump for every case, we do not believe it is worth the effort.

Regarding indirect jumps with multiple possible targets, or those for which none of the targets is the immediately following instruction, we simply add user-defined cross-references in IDA.Using these steps, we managed to fully recover the AuraStealer’s control flow.

Note that due to the heavy control&nbsp;flow obfuscation with many references to code locations, IDA often struggles to recognize proper function boundaries. It is thus often necessary to manually adjust where the function begins and ends to ensure IDA analyses the whole function.<h3>Exception-Driven API Hashing</h3>To obfuscate its usage of WinAPI functions, AuraStealer employs the API hashing technique. For these purposes, it first resolves all the functions required by the binary via PEB-walking and builds two hash-based lookup tables that maps hashes to XOR-masked addresses.&nbsp;The reason for maintaining two tables is that AuraStealer does not invoke these function directly. Instead, it deliberately triggers an exception, which, however, is intercepted by a custom exception handler. The handler inspects the address from which the exception originates and uses that information to dispatch the appropriate function address.To resolve a specific function, AuraStealer takes the precomputed <code>MurmurHash3</code> value (seeded with <code>0xDEADBEEF</code>) of the function’s name, re-hashes it with <code>FNV-1a</code>, and uses both values to query the first precomputed lookup table. The query returns the XOR-masked address from which the exception is to be thrown, together with the mask used to protect it. AuraStealer then unmasks the address and makes a call to it, intentionally throwing an <code>EXCEPTION_ACCESS_VIOLATION</code>, which is intercepted by the custom exception handler.&nbsp;The exception handler rehashes the originating address using <code>FNV-1a</code> and uses both values to query the second precomputed lookup table. This query returns the XOR-masked address of the actual target function, again along with the mask. The two values are XORed together and the resulting address is loaded into the <code>EIP</code> register, effectively invoking the requested WinAPI function.

The MurmurHash3 values of the target functions are further obfuscated using an XOR mask (see Figure 16). In this example, <code>0x130B0F3C ^ 0x25A36E25 = 0x36A86119</code>, which is equal to the value returned by <code>MurmurHash3(“GetModuleHandleA”, seed: 0xDEADBEEF</code>).&nbsp;Since the result value is produced only by a XOR of two constants, IDA’s decompiler can optimize the expression and directly display the deobfuscated value (see Figure 17).&nbsp;This allows us to precompute the hashes for all API-hashed functions and replace the decompiler-computed constants with the corresponding function names. However, it is important to note that this approach relies on IDA’s decompiler, which may produce incomplete results if the control flow is not fully deobfuscated. That said, the constants could also be recovered by combining backward slicing to isolate the instructions that influence the final constant value, and emulating them with an emulation framework (for example, Unicorn). In this case, removing the obfuscation would be considerably easier than for the indirect control flow obfuscation, as the constant obfuscation is merely an XOR, requiring emulation of only a few instructions. Moreover, these instructions are consistently located in the same basic block where the deobfuscated constant is used.

The exception handler is installed within the initterm routines, i.e., before the program reaches <code>WinMain</code>, making its presence easy to overlook. As part of this setup, AuraStealer not only registers the exception handler itself but also allocates a memory blob via <code>VirtualAlloc</code>, which is later used to build the lookup tables and as a memory region from which the exceptions are triggered. &nbsp;

This mechanism effectively adds another layer of obfuscation. &nbsp;Although the custom handler ultimately processes the deliberately triggered exceptions, a debugger intercepts them first. Consequently, anyone analyzing AuraStealer in a debugger is flooded with <code>EXCEPTION_ACCESS_VIOLATION</code>, making the program appear unstable and obscuring its real behavior. This can easily lead the analyst to disable exception notifications only to make the program run. However, by doing so, they deliberately hide the malware’s custom exception handler in the process, causing an important part of its logic to go unnoticed. Additionally, the exception spam also serves as an anti‑debugging technique, as the overwhelming stream of exceptions disrupts the debugging workflow.<h3>String Obfuscation</h3>Although most strings in AuraStealer are obfuscated, the names of the functions that are dynamically resolved and intended to be hidden via API-hashing remain in plaintext.

Their addresses, however, are obfuscated using the same arithmetic-based obfuscation used to obfuscate the target addresses of indirect calls (Figure 22).

Still, since the computation relies solely on constant values, it is possible to use the same trick presented above – marking the variable used in the computation as constant – to let IDA’s decompiler to compute the target address. This is another excellent example of how this trick can significantly accelerate the analysis. Instead of meaningless offsets, the decompiled code directly reveals the function name being referenced (see Figure 23).

The remaining strings are encrypted using a stack-based XOR obfuscation. The encrypted string and its corresponding XOR key are first concatenated in memory from constant values, XORed together, and stored in memory. An example of how such a decryption routine looks at the assembly level is shown in Figure 24.

These decryption routines generally follow the same logic but include slight variations, and their length varies depending on the length of the decrypted string. The main challenge is that emulating instructions withing isolated basic blocks and reading the strings from memory once the decryption is finished is not sufficient to recover all strings, as many of the constants involved in the string-decryption logic are reused throughout the function. Therefore, the necessary context is distributed across the entire function. As a result, recovering all strings requires emulating much larger code regions to preserve the full context, a task that can quickly become error-prone and time-consuming.&nbsp;Therefore, to decrypt AuraStealer strings, we implemented a simplified form of function emulation using the Unicorn emulation framework. Rather than emulating the entire function, we selectively step through its instruction, while skipping call instructions and loops. When reaching conditional branches (e.g., <code>if</code>&nbsp;or <code>switch</code> constructs), we fork the execution to explore and cover all relevant paths. This streamlined approach was sufficient to recover most of the obfuscated strings without resorting to full, heavyweight emulation.&nbsp;

A <a href="https://github.com/avast/ioc/blob/master/AuraStealer/extras/aurastealer_decrypt_strings.py" target="_blank">reference script</a> implementing the decryption workflow is available on our GitHub. The script is intended to be run from IDA Pro. &nbsp;<h2>Anti-Analysis Execution Chain</h2>During its execution, AuraStealer performs multiple anti-analysis checks, ranging from basic to more sophisticated techniques. Some of these checks are executed unconditionally, while others depend on configuration parameters specific to the particular infostealer build. The execution flow is displayed in Figure 26.

<h3>Running Protected Check</h3>AuraStealer’s anti-analysis chain begins by checking whether the binary is executed from a protective layer such as a loader, packer, or crypter. Depending on that outcome, it either performs or skips additional checks, which include an anti-tampering check and a dialog box check.&nbsp;<h3>Anti-Tampering Check</h3>The anti-tampering check is done using the <code>MapFileAndCheckSumW</code> WinAPI function, which computes the file’s checksum and compares it against the value stored in the PE header. If those values differ, AuraStealer stops its execution.The purpose of this check is to prevent analysts from patching or otherwise altering the executable. With that in mind, analysts should be cautious about any changes made to the binary (including software breakpoints) and remain vigilant during dynamic analysis, as the malware may deliberately exhibit misleading behavior if tampering is detected.&nbsp;<h3>Dialog Box Check</h3>Similar to what <a href="https://outpost24.com/blog/lummac2-anti-sandbox-technique-trigonometry-human-detection/" target="_blank">Lumma</a>, and more recently also <a href="https://research.checkpoint.com/2025/rhadamanthys-0-9-x-walk-through-the-updates/" target="_blank">Rhadamanthys</a>, does, if AuraStealer detects that it is being run unprotected, it displays a dialog box prompting the user to enter a code to continue. Unlike Lumma and Rhadamanthys, it requires the user not only to click the OK button but also to correctly enter the displayed code. On the other hand, it does not display any warning message that malware is to be run, which is what both Lumma and Rhadamanthys display in the message box.

This mechanism halts AuraStealer’s execution until the correct value is provided and is aimed at forcing the malware distributors to deliver the stealer with an additional protective layer. Additionally, it also serves as an anti-sandbox protection since automated sandboxes would hardly ever perform OCR over that text and try to paste it. Both the window title and the code to be entered are randomly generated at runtime, based on the Mersenne-Twister pseudorandom number generator.&nbsp;<h3>Geolocation Check</h3>To avoid execution in specific countries, AuraStealer performs a geolocation check by retrieving the system and user language settings using the WinAPI functions <code>GetUserDefaultLCID</code> and <code>GetSystemDefaultLCID</code>, and obtains the country code through <code>GetLocaleInfoA</code>. The retrieved country codes are then compared against a predefined blacklist, and if any match is found, the malware terminates its execution.

Notably, in addition to avoiding execution in CIS countries, the stealer also omits the Baltic states (Lithuania, Latvia, and Estonia). &nbsp;&nbsp;According to the AuraStealer developers, an extra IP check is allegedly performed on the server side. However, we were unable to confirm that claim.<h3>Anti-Sandbox Checks</h3>If all previous checks pass, the process continues to the anti-sandbox stage, which comprises three primary checks.First, AuraStealer evaluates whether the <code>Sleep</code>&nbsp;function has been hooked or modified. To do so, it records the system time using <code>GetSystemTimePreciseAsFileTime</code>, invokes <code>Sleep(1000 ms)</code>, and queries the system time again. If the measured delay is less than 900 ms, the stealer assumes that the <code>Sleep</code> function has been tampered with.Next, it performs a Microsoft Defender emulation check by comparing the values returned by <code>GetUserNameW</code> and <code>GetComputerNameW</code> against the well-known emulator artifacts <code>JohnDoe</code> and <code>HAL9TH</code>.&nbsp;Finally, AuraStealer inspects the list of currently loaded modules and compares them against the following list of blacklisted DLLs:

<h3>Configuration Extraction</h3>The configuration for each AuraStealer build is embedded directly in the binary and is protected with AES-CBC encryption. The encrypted configuration is stored as a single contiguous block, with a linear, serialized layout. The encrypted configuration structure is as follows:

Since all information required to decrypt the configuration is contained within the binary, it is possible to decrypt the content and extract the malware configuration.

Based on the configuration, AuraStealer performs additional anti-analysis checks. If all checks pass, it attempts to establish connection with the C2 servers listed in the configuration and initiates the data-stealing process. The configuration also allows setting custom user agents, defining a start delay, and choosing whether the malware should delete itself after completing the stealing process. Interestingly, although anti‑debugging appears as a configurable option in the configuration, it cannot be disabled from the panel. Furthermore, even though proxy support is not explicitly listed in the configuration, AuraStealer is expected to handle proxy usage. This is indicated by both the available build options in the AuraStealer panel and the strings observed in the configuration-parsing logic within the binary.

To streamline the process of retrieving build configuration data from AuraStealer samples, we provide a <a href="https://github.com/avast/ioc/blob/master/AuraStealer/extras/aurastealer_config_extractor.py">configuration extraction script</a>. The script is publicly accessible on our GitHub.<h3>Human Checks</h3>The human check comprises two subchecks, both implemented as infinite loops.&nbsp;The first check monitors whether the user input changes over time. It begins by measuring the number of ticks between two <code>GetTickCount</code> calls with a <code>Sleep(1000 ms)</code> in between. A while loop then repeatedly performs a <code>Sleep(500 ms)</code> followed by a call to <code>GetLastInputInfo</code>, which returns a <code>LASTINPUTINFO</code> structure. This structure contains a variable, <code>dwTime</code>, representing the tick count at which the last input event occurred. Then, another call to <code>GetTickCount</code> is made, and <code>dwTime</code> is subtracted from it. If the result is less than the previously measured number of ticks measured by the one-second <code>Sleep</code>, the check passes. Otherwise, the loop repeats until the check passes.&nbsp;The second check begins by a call to <code>GetForegroundWindow</code>, which returns a handle to the current foreground window. A while loop then repeatedly calls <code>Sleep(500 ms)</code> and checks <code>GetForegroundWindow</code> again. If the returned handle differs from the initial one, the check passes. Otherwise, the loop continues until the foreground window changes.&nbsp;<h3>Anti-VM Checks</h3>The Anti‑VM check consists of multiple subchecks. First, the presence of a hypervisor is checked using the <code>cpuid</code> instruction. When <code>cpuid</code> is executed with <code>EAX = 1</code>, the 31st bit of <code>ECX</code> indicates the environment – it is <code>0</code> on a physical machine and <code>1</code> on a virtual machine.Next, a combination of the WinAPI functions <code>GetDesktopWindow</code> and <code>GetWindowRect</code> is used to obtain the <code>right</code> variable from the resulting <code>RECT</code> structure, which is then compared against <code>1024</code> (it is expected to be greater). Finally, <code>GlobalMemoryStatusEx</code> is called, and the <code>ullTotalPhys</code> variable of the returned <code>MEMORYSTATUSEX</code> structure is checked to ensure it is not <code>0</code>.If all of these checks pass, AuraStealer calls <code>GetSystemInfo</code> and inspects the returned <code>SYSTEM_INFO</code> structure to verify that <code>dwNumberOfProcessors</code> is not less than four. If the system has four or more processors, the Anti‑VM check is considered passed. If the processor count is below this threshold, the malware performs one additional verification using <code>EnumProcesses</code> to retrieve the list of running processes. It then checks whether the total number of running processes is at least <code>200</code>, which is assumed to be typical for a real, non‑virtualized system.

<h3>Anti-Debug Checks</h3>The anti-debug check comprises several subchecks, beginning with inspecting well-known debug flags in the <code>PEB</code>, including <code>BeingDebugged</code> and <code>NtGlobalFlag</code>, as well as the <code>KUSER_SHARED_DATA</code> structure. A detailed explanation of how these flags can be used to detect a debugger can be found <a href="https://anti-debug.checkpoint.com/techniques/debug-flags.html">here</a>.

If all previous check pass, AuraStealer creates a new debug object using <code>NtCreateDebugObject</code> and makes a subsequent call to <code>NtQueryObject</code>. Since the object was just created, there should exist only a single handle to it – the one held by the program itself. However, if a debugger or other monitoring tool is attached (which often hooks these functions or duplicates handles for analysis), the <code>HandleCount</code> may be greater than one. In that case, AuraStealer proceeds to compare the names of all running processes against a hardcoded blacklist, and if any match is found, it terminates its execution.

Notably, as careful readers may notice in the decompiled anti-debug and anti-VM check functions, AuraStealer employs an additional anti-debugging technique that is utilized across various functions within its codebase. The technique works by inspecting the opcodes located at the function’s return address. If a breakpoint instruction (<code>INT3</code> or <code>INT&nbsp;3</code>) or a <code>UD2</code>&nbsp;instruction (commonly used for hooking) is detected, a random value between 64 and 127 is generated and added to a stack variable at offset <code>−4</code> from the return address. The intent behind this technique is not to crash the program immediately, but to plant a subtle corruption that only results in a crash later during execution, making it very hard to determine the crash origin.

<h2>AuraStealer Execution Flow</h2>The high-level execution flow of AuraStealer can be summarized as follows. First, the malware installs the custom exception handler and creates the two lookup hash tables used for its exception-driven API hashing. Next, it performs multiple anti-analysis checks described above and decrypts its embedded configuration. If all checks pass, it proceeds with mutex creation.&nbsp;Based on the hosts specified in the configuration, it attempts to establish a connection with its C2 servers, which respond with additional configuration specifying what information and files should be collected. Finally, the malware begins collecting the targeted data and exfiltrating it to its remote infrastructure.&nbsp;

As for the AuraStealer’s capabilities, it targets nearly every aspect of the user’s digital life. Specifically, it is capable of collecting:<ul><li data-list-item-id="ee8f738bb398ebf4b98d308b3e83f7ba9">Sensitive data from both Chromium-based and Gecko-based browsers</li><li data-list-item-id="ef6e95e7a4b7566401304a3ac2c1bb99e">Cryptocurrency wallets from desktop applications and browser extensions</li><li data-list-item-id="e46204802ac7c574e54061fbe7715f64d">Active session tokens (Discord, Telegram, Steam)</li><li data-list-item-id="e1402956eda9d7b9e9ca2f50084aa8b53">2FA tokens (Authenticator)</li><li data-list-item-id="ebfbbc8ff75ab08f22978d0e4d853c0b9">Recovery data (recovery seeds, private keys, and mnemonic phrases)</li><li data-list-item-id="ea5cfba5a39e294f4b4d425d13f586f36">Credentials and API keys</li><li data-list-item-id="edbbd9e9dda770df72e0adc3e82e03cf8">Remote access and FTP configurations (AnyDesk configurations, FileZilla credentials)</li><li data-list-item-id="e63d9a0d397bf3f49f53fdf30a2c8bdce">Password manager databases (KeePass, Bitwarden,&nbsp;1Password,&nbsp;LastPass)</li><li data-list-item-id="ebf62d564d3b18ae02881d21d0e8178ff">VPN configurations (OpenVPN, NordVPN, ProtonVPN)</li><li data-list-item-id="e407c5c635ddee8cc7ea0a4caa0728141">Clipboard contents</li><li data-list-item-id="e499de30c13fcd2f06971c7091c9e5a01">Screenshots of the victim’s device</li><li data-list-item-id="e8df9f43c63afc51e163e786a3a89171f">A list of running processes, along with general system fingerprinting data</li></ul>However, this is not an exhaustive list as AuraStealer allows to include additional custom configuration modules for specific builds (including wildcard-based file search with configurable masks, paths, and recursion), effectively enabling the theft of virtually any file of interest.Beyond data theft, AuraStealer is also capable of executing additional payloads.&nbsp;

<h3>Dynamically Generated Mutex</h3>To prevent multiple instances from running simultaneously, AuraStealer utilizes dynamically generated mutexes based on build-specific and time-dependent values. The malware first loads the <code>build_id</code> value from its configuration (for example, <code>a0858933-16a7-433f-a9cc-68490ace0576</code>) and computes a <code>djb2</code> hash over it. The hash is then added to the result of an integer division <code>_Xtime_get_ticks()/36000000000</code>, which effectively produces a value that changes once per hour. The final sum serves as a seed for a Mersenne-Twister pseudorandom number generator, which is used to generate a random alphanumeric string between 16 and 32 characters in length. The generated string is prepended with <code>Global\</code>, forming the final mutex name.&nbsp;

The fact that the mutex changes every hour highlights that the stealer is designed to run only for a short period of time – a trend that has become increasingly common among modern infostealers. The goal is to execute briefly, steal as much data as possible, and, preferably, remove all traces of its presence.<h2>Application-Bound Encryption Bypass</h2>To extract sensitive data from Chromium-based browsers, AuraStealer must first overcome Application-Bound Encryption (ABE), which it achieves by spawning the target browser in headless mode using <code>CreateProcessW</code>, with the process created in a suspended state, followed by a code injection. From within the injected context, the malware invokes <code>IElevator::Decrypt</code> to decrypt the <code>app_bound_encrypted_key</code>, which enables the decryption of any ABE-protected data, including passwords and cookies.

The injection itself is implemented by creating a shared section via <code>NtCreateSection</code> and mapping it into the target browser process using <code>NtMapViewOfSection</code>, after which the injected payload is executed using <code>NtCreateThreadEx</code>. All of the NTDLL calls involved in the injection are executed through Heaven’s Gate, a technique that allows 64-bit code to be executed from a 32-bit process on a 64-bit OS. This ensures both compatibility with 64-bit browsers and also helps evade detection.

The injected payload is a position-independent shellcode, slightly modified at runtime for each target browser process. At predefined offsets within the shellcode, AuraStealer fills two randomly generated file names with the paths of the form <code>C:\Users\&lt;user&gt;\AppData\Local\Temp\&lt;random_alphanumeric_string_len_16_to_32&gt;</code>, along with a value identifying the browser type, which is later used to select the appropriate CLSID and IID for the <code>CoCreateInstance</code> invocation. These two files serve as an inter-process communication mechanism between AuraStealer and the injected shellcode. The first file is used to pass the encrypted <code>app_bound_encrypted_key</code> to the injected shellcode, while the second file is used by the shellcode to write back the decrypted key for retrieval by the stealer.Although AuraStealer is capable of decrypting the <code>app_bound_encrypted</code> key, required to decrypt appbound-encrypted data, from certain Chromium-based browsers, it still does not work reliably across all of them, suggesting that the product has not yet reached a fully polished state.<h2>Network Traffic</h2>AuraStealer’s network traffic can be divided into four stages. The stealer first verifies internet connectivity by checking the reachability of <code>1.1.1.1:53</code> (Cloudflare). Upon success, it attempts to establish communication with its C2 infrastructure by querying the <code>/api/live</code> endpoint and expecting a response<code> true</code>. If any of the servers are reachable, it then requests <code>/api/conf</code>, together with its <code>build_id</code>, to retrieve a build-specific configuration defining the data to be collected (a <a href="https://github.com/avast/ioc/blob/master/AuraStealer/extras/aurastealer_config.json">sample configuration</a> is publicly available on our GitHub repository). Finally, the collected files are split into smaller archives and sent in parts as they are collected via the <code>/api/send</code> endpoint.

All network traffic is encrypted using AES-CBC in a manner very similar to the configuration encryption, with the difference that the encrypted data is additionally Base64‑encoded. The encryption keys and initialization vectors are generated randomly at runtime.&nbsp;

<h2>Key Takeaways and Defensive Measures</h2>AuraStealer&nbsp;is a rapidly growing infostealer that employs a wide range of obfuscation and&nbsp;anti-analysis techniques to evade both static and dynamic detection. Apart from targeting nearly every aspect of users’ digital life, it also allows for the inclusion of additional custom configurations with configurable masks, paths, and recursion, effectively enabling the theft of virtually any file of interest.What You Can Do:<ul><li data-list-item-id="eb280f4b40c8c43a487e430bf4e03ce08">Use reputable security software&nbsp;with real-time protection. Products from Norton, Avast, AVG, and Avira automatically protect users against the attacks and threats described in this analysis.</li><li data-list-item-id="ed7873c63b2df660cc976bfc5cfa76db3">Avoid copying and pasting commands&nbsp;from unknown or suspicious sources into system dialogs like Windows Run or PowerShell.</li><li data-list-item-id="ea6982ffdde4d0fb169e72869e66b63a4">Verify software sources&nbsp;– avoid downloading cracked games, software activators, or suspicious browser/IDE extensions.</li></ul><h3>IoCs</h3>0223E39D9C26F065FABB1BCB8A1A03FE439BB18B8D14816646D8D236A6FD46A3 (AuraStealer 1.0.0)01E67139B59EED0FE1FCB4C66A9E88AD20DD8B55648C077AEC7FA2AE3431EA5F (AuraStealer 1.1.0)9A46C8D884F4C59701D3AF7BEAD1E099E3DDEB1E2B75F98756CC5403D88BD370 (AuraStealer 1.1.1)FD3875225C1AB60E6DC52FC8F94B4D389624592B7E7B57EE86E54CEBE5D3EB6A (AuraStealer 1.1.2)EC7BA08B1655963D6C9F7D996F3559C58893769A2C803DA1F99610A0AAA1224A (AuraStealer 1.2.0)0F691762DA02ABBD94046381ECEDFD8B31CCBB835DED6049E9D6CD2AFDD3F551 (AuraStealer 1.2.1)F6E7341AB412EF16076901EA5835F61FBC3E94D0B9F2813355576BAD57376F29 (AuraStealer 1.2.3)D19274A14B905679DBD43FFB374CA0E11F9DC66FDB9E17236829A9A56F3E7D31 (AuraStealer 1.3.0)F0F7AE1FC2D569B8B9267D2EC81F7E539DB4BEAF275BCA41962C27ECFA5361BF (AuraStealer 1.4.0)158369AD66EA4BACEEE19051425C21F657FFC1B3483EA812323816B612F324BD (AuraStealer 1.5.0)F816558972F62D206757BAD4A95EE75290615F520F3B24D814FFBCDFC6998C6C (AuraStealer 1.5.1)F7D0F099D042DE83AA2D0A13100640BEA49D28C77C2EB3087C0FB43EC0CD83D7 (AuraStealer 1.5.2)apachesrv[.]cfd (C2) argametop[.]cfd (C2) armydevice[.]shop (C2) browsertools[.]shop (C2) calibrated[.]cfd (C2) chicagocigars[.]shop (C2)&nbsp; clocktok[.]cfd (C2) connupdate[.]cfd (C2) coralpoint[.]cfd (C2) cybertool[.]shop (C2) gamedb[.]shop (C2) glossmagazine[.]shop (C2) goldenring[.]cfd (C2) greenapi[.]cfd (C2) magicupdate[.]cfd (C2) mscloud[.]cfd (C2) mushub[.]cfd (C2) opencamping[.]shop (C2) privateconnect[.]cfd (C2) searchagent[.]cfd (C2) searchservice[.]cfd (C2) softytoys[.]shop (C2) stmservice[.]cfd (C2) sysrequest[.]cfd (C2) systemupdate[.]cfd (C2) unknowntool[.]shop (C2) updservice[.]cfd (C2)

A technical walkthrough of obfuscation, anti-analysis and data theft capabilities

Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers

<h2 class="text-align-justify">Key Points</h2><ul><li>Gen Threat Labs has discovered and analyzed an elaborate Traffic Direction System infrastructure delivering FakeCaptcha, tech scams and other malware campaigns to select users.&nbsp;</li><li>The campaign entry points are infected or otherwise attacker-controlled streaming websites, file sharing services, as well as malvertising campaigns.&nbsp;</li><li>Victims are evaluated based on geolocation, IP address, and browser fingerprinting; for example, connections through VPNs or headless browsers are detected and rejected.&nbsp;</li><li>The FakeCaptcha campaign is increasing its stealth by mimicking legitimate software websites.&nbsp;</li><li>A new variant of FakeCaptcha spreading information stealers and RATs avoids detection by employing Unicode math fonts.&nbsp;</li></ul>

<h2>Introduction</h2>The <a href="https://www.gendigital.com/blog/insights/research/global-surge-in-fake-captcha-attacks" target="_blank" rel="noreferrer noopener">FakeCaptcha campaigns</a> have become a widespread malware infection vector, using clever social engineering and exploiting internet users’ confusion about common CAPTCHA practices to trick victims into infecting their own computers, typically with information-stealing malware like LummaC2, by pasting malicious commands into the Windows Run dialog.&nbsp;We have discovered an elaborate infrastructure actively used to deliver multiple variants of FakeCaptcha and other malicious content to select users. At the core of the operation is an attacker-controlled Traffic Direction System network. It has a single purpose—to fingerprint the visitor’s device and network details to determine what type of content to deliver. This could be malicious, monetized or decoy content, or no content at all. For reasons we will describe later, we are calling this infrastructure HelloTDS.

As shown in the graphic above, the scope of the campaign is massive; in April and May 2025 alone, we have protected over 4.3 million users worldwide. In terms of absolute numbers, the most affected regions include the United States, Brazil, India, and Western Europe. However, when adjusting for population size and user base, a different trend emerges: the highest relative risk is concentrated in the Balkan countries of Europe and in parts of Africa, particularly Rwanda, Egypt, Tanzania, and Kenya.<h2>Attack Chain</h2>At a high level, the attack works as follows: The victim visits an infected website or clicks on a malicious ad. The entry website requests a JavaScript file from the initial HelloTDS endpoint, which fingerprints the connection and decides whether to serve content or stay idle. If the user is not deemed a suitable victim, the attack stops here. Otherwise, the server responds with a script that further fingerprints the browser, logs mouse movements and similar, eventually sending another request to receive the final payload containing a redirect to the malicious landing page. Among users who passed the initial check, FakeCaptcha was observed to be the most prevalent malicious landing page, with Fake Updates, file downloads containing encrypted malware, tech scams and other fraudulent campaigns also having a share.&nbsp;

One specific example of the full attack chain is illustrated in the next figure: We visited the website dailyuploads[.]net, uploaded an arbitrary image file, and navigated to the link generated by the service. The resulting page included a script from HelloTDS, and when we clicked the download link, we were involuntarily redirected to a FakeCaptcha landing page attempting to trick visitors into executing the Emmenhtal loader.

<h2>From Movie Streaming or File Sharing to Malware</h2>Besides ad networks, the primary source of traffic for HelloTDS are legitimate-looking, properly functioning websites, such as movie streaming sites, torrent mirrors, file-sharing services, link shorteners, or porn websites. However, these websites are specifically crafted or manipulated—presumably also by the attacker—to cooperate with the attacker’s infrastructure and load malicious scripts. This tactic completely bypasses the need for malvertising campaigns through “legitimate” advertising companies, as these websites request the attacker’s scripts directly.Moreover, we have observed a repeating pattern in some of these websites, which offer file sharing services and promise their users financial gains. These include dailyuploads[.]net, streamtape[.]{com,net,to}, watchadsontape[.]com, bigwarp[.]art or savefiles[.]com to name a few. Security or data privacy is clearly not a priority for these services, as anyone can sign up with any e-mail address without verification. We suspect that these websites are cloned from some existing file sharing service and controlled by the same threat actor who controls HelloTDS and eventually delivers FakeCaptcha, for the primary purpose of embedding malicious popups and redirects within the page (although email &amp; password harvesting could be a “welcome” byproduct).

<h2>The Anatomy of a HelloTDS Domain</h2>An “entry point” website, like those described previously, will usually statically embed one or more HTML snippets loading remote JavaScript that look like this:

(In case of file-sharing websites described above, this snippet will be included in the page with the uploaded file, i.e. the one you share the link to, but not on the main page itself.)The source domain is randomly rotated and both path segments are randomly generated (although their length and character sets are always the same), presumably to prevent static detection. Despite this, it is easy to spot these URLs with a human eye (or a clustering algorithm). All the HelloTDS domains we have seen so far have the same format: The apex domain consists of 2-3 (pseudo)words with a “.top”, “.shop” or sometimes “.com” TLD; optionally, a short subdomain is used, consisting of usually 2, but up to 4 random letters.&nbsp;Examples of these domains include:<ul><li>yr[.]unasonoric[.]com</li><li>gq[.]binesyorker[.]com</li><li>sb[.]rowlandpodogyn[.]shop</li><li>nutatedtriol[.]com</li></ul>

Apart from the distinctive domain names, another sign that speaks for HelloTDS is that the domain names are almost exclusively registered in Panama through the Pananames registrar, and the servers reliably present Let’s Encrypt certificates during TLS handshakes.In an attempt to make tracking HelloTDS infrastructure difficult, the authors designed it to be highly dynamic, frequently rotating active domains and their DNS records. Even so, we have identified that all domains associated with this infrastructure are registered under AS7979 (SERVERS-COM) within the following IP ranges:<ul><li>23.83.64.0/22</li><li>23.109.120.0/22</li><li>23.109.128.0/19</li><li>23.109.170.0/24</li><li>94.242.232.0/21</li><li>172.240.104.0/21</li><li>172.241.48.0/21</li><li>172.255.96.0/20</li><li>173.0.146.0/23</li><li>173.237.64.0/20</li><li>188.42.104.0/21</li><li>188.42.240.0/21</li><li>209.192.192.0/18</li><li>212.117.184.0/21&nbsp;</li></ul>

Another interesting aspect shared by all HelloTDS servers is the usage of the non-standard HTTP header “megageocheckolololo”, which we believe is not commonly used by any well-known service. Its presence in the “Access-Control-Allow-Headers” HTTP response header is another indicator of a HelloTDS server.

Lastly, domains belonging to HelloTDS can be reliably identified using the information they expose via “robots.txt”:

The “/hi” endpoint always returns a simple HTML response with a single text node that says “Hello!” — hence the name HelloTDS.<h2> First Stage: Fingerprinting Based on Network Information</h2>The first decision is made by the HelloTDS server immediately upon receiving the request sent from one of the entry point websites. Since we can only send requests and observe the servers’ responses, it is difficult to tell the exact shape of the server’s decision tree. We suspect that several factors, such as IP/geolocation checks, timeouts, or maybe even pure randomness, may contribute to the result in some way.From the user’s point of view, there are two possible outcomes. In one case, the server responds with a no-op script (usually an empty function or a single-line comment containing 2 or 3 letters, like “// ipx” or “// mt”, likely codes used for “debugging” the TDS), meaning the user will not get any malicious content (from that endpoint). Alternatively, the server will respond with a large JavaScript that performs heavy client-side fingerprinting and eventually performs a subsequent request to another HelloTDS endpoint. Either way, the server sets a pair of cookies in the response; these encode information about the client’s browser, operating system and network, as detected by the server, and may be used as a client-side cache for further requests (although we have found that tampering with them is generally not useful).

The cookie values contain Zlib-compressed binary data encoded in Base64. Although the low-level data format is unknown, the data itself contains readable ASCII strings like the client’s IP address, country, or ISP, which reveal the purpose these cookies likely serve.

<h2>Second Stage: Fingerprinting in the Browser</h2>Contrary to the logic executed on the server, the next fingerprinting routine is performed in the browser (by the returned JavaScript) and can thus be reverse-engineered. The exact code returned from different HelloTDS endpoints varies somewhat in structure and complexity (at the very least, the server appends a timestamp comment to hinder hash-based detection), but all of them share the same basic high-level functionality.Crucially, the JavaScript sent by the server contains an encrypted configuration variable — a JSON string where each alphanumeric character is substituted with some other. This part of the code can be easily identified: Look for a function call with two arguments, the first being the encrypted JSON string and the second being the key: A concatenation of the characters a-z, 0-9 and a random permutation thereof. This obfuscation is not unique to HelloTDS; however suspicious it may be for an ad network to employ this technique, we have also observed this behaviour in scripts employed by the Czechia-based Clickadu ad network, which happens to share certain characteristics with the threat actor’s infrastructure.The number of key-value pairs in the configuration object varies, but some common ones we regularly encounter are “url”, “zone_id”, “uuid_url”, “rot_url”, “metric_url”, “timezone_offset” and/or “timezone_diff”. Other keys that particularly stand out due to their names are “devtools_protection” and “philanthropic_level”, which were set to “true” and 0 respectively whenever we inspected a chain that landed on FakeCaptcha in the end.The “*_url” keys contain further HelloTDS URLs, which are used to retrieve a sort of unique identifier (“uuid_url”), the target URL (“rot_url”), an endpoint to report errors and other metrics to (“metric_url”), and an endpoint for mouse movement and device sensors tracking (“url”). Notably, the “rot_url” always contains a special parameter named “md” with a placeholder for the fingerprinting information collected by the script.

The JavaScript collects the following information:<ul><li>Basic browser info: window width and height, document referrer, window location (URL), browser language, current datetime, time zone offset, and whether the site is shown in a top-level window or an iframe,</li><li>the “user id” previously returned by the UUID endpoint,</li><li>whether or not a mobile browser is used (by checking if the deprecated window.orientation property is defined),</li><li>whether or not a touch screen is present (by reporting the value of the window.navigator.maxTouchPoints property),</li><li>page title information, most common words in the host webpage as well as any keywords declared in the host document’s head element,</li><li>the approximate amount of physical memory and the number of processor cores,</li><li>battery status (level, charging state),</li><li>WebGL vendor and renderer,</li><li>a “sandbox score” consisting of 6 flags, e.g., whether the browser is Headless Chrome, or whether specific video codecs are supported,</li><li>network information, e.g., network type (Wi-Fi, Ethernet, cellular, …), effective and maximum bandwidth, or the estimated round-trip time,</li><li>screen orientation and colour depth,</li><li>whether cookies are enabled.</li></ul>

A JSON object containing this information (as well as some keys from the config) is Base64-encoded and sent in the md parameter to the rotated URL from the config via a POST request. The response contains a JSON object with a “url” key as well as a TTL and bidding details.

The returned URL is the last HelloTDS endpoint in the whole chain.<h2>Third Stage: Final Payload with Redirect to Landing Page</h2>The final step in the HelloTDS pipeline is a simple JavaScript-based redirect to the target URL.

In this case, bestfree4u[.]com simply responded with a 301 redirect to a FakeCaptcha landing page at finding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html. However, when accessed from a different environment, the same domain may seem harmless. In other cases, the final HelloTDS redirect leads to tech support scams, malicious file downloads, fake browser updates, potentially unwanted browser extensions, or cryptocurrency investment platforms.<h2>The Destination: FakeCaptcha Redirectors</h2>In the past months, we have seen a highly predictable pattern in the malicious URL payloads served by HelloTDS: Almost universally, they were machine-generated domains consisting of a couple of English words and a “.com”, “.shop”, “.online”, “.info”, “.live”, “.pro” or similar TLD, and the URL path was a string with 24 hexadecimal digits, the first two usually being 67 or 68. These URLs served as simple redirects, either to FakeCaptcha, or sometimes to a decoy—usually some (benign but potentially unwanted) browser extension or cryptocurrency product website. We have seen multiple of these URLs redirect to both a FakeCaptcha landing page and a decoy at different times, which removes any doubt about this being an inherently malicious service. Example URLs include the following:<ul><li>actednow[.]com/675cb495c39bc481ddf8edd6,</li><li>buzzflying[.]shop/6767af2ee2aa535e92d62a64,</li><li>goldtera[.]live/6758b1d6467532a801fa06c4,</li><li>orbito[.]online/677120fb2cca41d88a7392a2.</li></ul>The domains used by this service could be reliably identified by being registered under Namecheap in Reykjavik, Iceland, using a Let’s Encrypt TLS certificate, and resolving to one of the following IP addresses:<ul><li>5.161.37.228,</li><li>5.161.110.119,</li><li>5.161.178.111,</li><li>23.105.163.27,</li><li>23.105.163.55,</li><li>34.142.174.238,</li><li>172.104.80.249.</li></ul>Recently, the attacker has started employing more sophisticated masking even at the level of the final payload.Additionally, the structure of served URLs redirecting to FakeCaptcha has changed – they now often include parameters with placeholders, which may not even be filled in, yet the victim can still be redirected to a FakeCaptcha landing page. We have seen different variations of these URLs, some of which omit specific parameters.

Interestingly, some of the URLs served by HelloTDS redirect victims to FakeCaptcha landing pages, but when accessed in a controlled environment, they often mimic some legitimate websites and serve some benign content. One example of such a website is&nbsp;hxxps[://]avs4u[.]net/?sub1=39388&amp;sub2=…&amp;sub3=ID&amp;sub4=677886&amp;sub5=0.0004752 — while it often redirects the victims to FakeCaptcha landing pages, it may also display mimicked content of the legitimate website www.avs4you.com, a software for processing videos and images. The downloadable binary is also legitimate, indicating an attempt to conceal malicious activity.Another example of a URL redirecting victims to FakeCaptcha but serving legitimate content in a controlled environment is hxxps[://]arcadeclassic[.]org/?sub1=681978&amp;sub2=0.00037565.&nbsp;

We therefore tried to understand the reasoning behind the decision of whether malicious content is served. As part of this effort, we explored the potential influence of the cookies being set, which we mentioned earlier. Ultimately, we have concluded that the decision is probably based solely on the IP address of the client. We suspect that if the IP address originates from a known VPN or other anonymizing services, the victim is consistently redirected to some benign content, likely because such users are not target victims and may potentially be security analysts. In such cases, HelloTDS delivers benign content to obscure its actual behavior, effectively evading analysis and avoiding detection.<h2>Delivered Malicious Content</h2>In our analysis of HelloTDS landing page redirectors, we observed that they serve a mix of both malicious and legitimate content. These “clean” redirects, however, often lead to investment-related sites, especially those involving cryptocurrencies. We believe that this choice is deliberate. Firstly, generating traffic to advertisers through non-consensual clickjacking may serve as an alternative, more predictable source of income for the attacker without “stepping into the dark” and serving hard malware. Furthermore, if the primary objective of FakeCaptcha is to infect victims with information stealers that ubiquitously target crypto wallets, redirecting users who were not deemed as ideal victims to a crypto investment platform may be the most logical strategy for the attacker in the long run.On the unequivocally malicious side, various forms of FakeCaptcha were predominant, but we have also encountered Fake Updates, tech scams, download links with encrypted archives delivering LummaC2, and various other scams. Some specific examples are listed below.

<h2>Key Takeaways and Defensive Measures</h2>The HelloTDS infrastructure behind FakeCaptcha campaigns demonstrates how attackers continue to refine their methods to bypass traditional protections, evade detection, and selectively target victims. By leveraging sophisticated fingerprinting, dynamic domain infrastructure, and deception tactics (such as mimicking legitimate websites and serving benign content to researchers) these campaigns achieve both stealth and scale.What You Can Do:<ul><li>Use reputable security software with real-time protection to block known TDS and FakeCaptcha domains. Products from Norton, Avast, AVG, and Avira automatically protect users against these threats.</li><li>Enable browser-level protections like anti-tracking and ad-blocking extensions, which may prevent the initial malicious scripts from loading.</li><li>Be cautious with file-sharing and streaming sites, especially those that promise monetary rewards or allow anonymous uploads without verification.</li><li>Avoid copying and pasting commands from unknown or suspicious websites into system dialogs like Windows Run.</li><li>Inspect suspicious domains manually or through security tools—look for signs like oddly-structured URLs, frequent domain rotation, or generic domain names.</li></ul>FakeCaptcha is not just a social engineering trick. It's the final step in a well-orchestrated system that filters, evaluates, and targets users with precision. Understanding the infrastructure—HelloTDS in this case—is key to disrupting the full chain of attack.<h2>Indicators of Compromise (non-exhaustive)</h2>You can find the complete list of IoCs on our <a href="https://github.com/avast/ioc/tree/master/HelloTDS">GitHub</a>.<h3>File Sharing Entry Websites</h3>dailyuploads[.]netstreamtape[.]tostreamtape[.]netstreamtape[.]towatchadsontape[.]combigwarp[.]artsavefiles[.]com<h3>HelloTDS Domains</h3>yr[.]unasonoric[.]comgq[.]binesyorker[.]comsb[.]rowlandpodogyn[.]shopnutatedtriol[.]commixscoggan[.]shopbu[.]unrimedironize[.]shop<h3>FakeCaptcha Redirectors</h3>actednow[.]com/675cb495c39bc481ddf8edd6buzzflying[.]shop/6767af2ee2aa535e92d62a64goldtera[.]live/6758b1d6467532a801fa06c4orbito[.]online/677120fb2cca41d88a7392a2bestfree4u[.]comavs4u[.]net/arcadeclassic[.]org<h3>FakeCaptcha Landing Pages</h3>adelaidavizcaino[.]com/cpwpartage-de-medias[.]fly[.]storage[.]tigris[.]dev/affiliate-link[.]htmlfinding-from-internet[.]fly[.]storage[.]tigris[.]dev/seacrh-result[.]html

Vojtěch Krejsa

Posts by Vojtěch Krejsa

Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections

GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers

Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer

VoidStealer: Debugging Chrome to Steal Its Secrets

Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers

Say hi to HelloTDS: The infrastructure behind FakeCaptcha

Vojtěch Krejsa

Posts by Vojtěch Krejsa

Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections

GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers

Remus: Unmasking The 64-bit Variant of the Infamous Lumma Stealer

VoidStealer: Debugging Chrome to Steal Its Secrets

Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers

Say hi to HelloTDS: The infrastructure behind FakeCaptcha

GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers