A new information stealer written in Rust is spreading through pirated software downloads, and it quits the moment it suspects a researcher is watching, showing the message "I love stealing cookies, but not on this machine. Sorry!" before exiting, AhnLab's ASEC team reports. The malware was first detected in mid-August and began spreading widely in early September after its operators changed how it runs.
What lifts it above a routine password thief is its reach. Beyond browsers, the configuration AhnLab recovered targets messengers, email clients, password managers, VPN and remote-access tools, database, FTP and SSH clients, cloud storage, AI and development tools, crypto wallets and gaming platforms, as well as certificates, SSH keys and document files. It can also download and run further malware, and AhnLab confirmed that feature was switched on in the configuration it analysed.
Small tests first, then a wide release
Early, small-scale samples, which AhnLab presumes were tests, ran through AutoIt, the Windows automation scripting tool. The operators then switched to injecting the stealer into the Windows Explorer process or running it standalone, and large-scale distribution followed. Some recent samples decrypt an embedded DLL and inject it into Explorer, and some copies arrived through a separate downloader.
Built to frustrate analysts
AhnLab highlights anti-disassembly using dynamic jumps, anti-sandbox checks that rely on CPU memory cache lookups, and DLL injection, techniques it says are not commonly seen in earlier stealers. Every internal string stays encrypted until the moment it is used, through a modified Base64 index table that differs between samples and is rotated again by a per-call key, so the same text can look different each time.
On launch the stealer sends its command server a profile of the machine (installed programs, CPU name, graphics driver, CPUID data and Windows version) and then receives instructions on what to steal. Traffic is XOR-encrypted with a per-sample key and compressed with Windows' LZNT1 algorithm, which AhnLab presumes is meant to defeat network-based detection. That evasive streak echoes other recent families such as 2CLoader, which also tries to fool sandboxes.
Hunt for injection into explorer.exe, not one file
Because the execution method changes from wave to wave, AhnLab advises looking for abnormal code injection into legitimate processes, particularly AutoIt.exe and explorer.exe, rather than relying on detection of one executable. Organisations should also check for large ZIP files downloaded from untrusted sources and then unpacked and run, and for traffic to suspicious command servers. Users should install software only from official sources.
AhnLab did not publish indicators in the public post; they are available to its TIP subscribers. The wider point holds without them: a stealer that lifts VPN and remote-access credentials from a PC that is also used for work turns one pirated download into a possible way into a company.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.