New Shuyal Stealer Malware Targets 19 Browsers, Disables Windows Task Manager for Stealth

New Shuyal Stealer Malware Targets 19 Browsers, Disables Windows Task Manager for Stealth reports that security researchers at Point Wild uncovered a new information-stealing malware, Shuyal Stealer, which expands beyond a few browsers to target 19 different ones.

According to Point Wild’s analysis, it conducts deep system profiling with Windows Management Instrumentation (WMI) to harvest granular hardware and configuration data, including commands such as wmic diskdrive get model and wmic path Win32_Keyboard get Description. A standout stealth feature is its ability to neutralise the Windows Task Manager: on execution it scans for taskmgr.exe and terminates it, then disables the Task Manager by setting DisableTaskMgr to 1 in the registry, with persistence across reboots.

For endurance, it copies itself into the Windows Startup folder via the CopyFileA API, and it exfiltrates data using a Telegram bot rather than traditional C2 servers. It hunts credentials from 19 browsers, captures clipboard contents and screenshots, and even steals Discord tokens, sending a runtime[.]zip archive back to a private Telegram channel before self-deleting with util.bat.