Stealit Malware spreads via fake game & VPN installers on Mediafire and Discord

Stealit is now spreading via fake game and VPN installers hosted on MediaFire and Discord, with Fortinet FortiGuard Labs researchers noting the campaign abuses Node.js Single Executable Application (SEA) and sometimes Electron to disguise the payload. According to Fortinet, the malware bundles itself into a multi-layered, obfuscated Node.js SEA executable and performs anti-analysis checks, saving a 12-character alphanumeric auth key to %temp%\cache.json for C2 authentication after passing these checks.

The installer then downloads Brotli-compressed components from root.iloveanimals[.]shop, stores them under the user’s AppData path, and persists by adding a startup.vbs script while evading Defender protection. Functionality advertised by the operators includes live screen and webcam monitoring, file theft, remote command execution and even ransomware delivery, with the C2 server collecting the victim’s username, hardware ID and the auth key to issue commands.

The Stealit site markets the stealer as subscriptions, listing prices of about $500 for Windows and $2,000 for Android, and a Telegram channel named StealitPublic, managed by a user with the handle @deceptacle, is used to share updates with potential clients.