SantaStealer Unwrapped: New MaaS Info-Stealer Rebrands Blueline to Steal Crypto and Credentials

According to Rapid7 Labs, SantaStealer is a new information stealer marketed as a Malware-as-a-Service and promoted on Telegram channels and underground forums, with a full release planned before the year ends. Discovered in early December 2025, the threat appears to be a branding rebrand of BluelineStealer, with the operators framing it as a fully C-written tool featuring a custom polymorphic engine designed to evade antivirus simply by branding.

Rapid7 analysts obtained unobfuscated samples showing the malware as a 64-bit DLL with more than 500 exported symbols and unencrypted strings hinting at credential-stealing capabilities. The sample relies on open-source libraries such as CJSON, miniz and sqlite3, and targets credentials, wallets, and data from a broad range of applications, aiming to operate in-memory to bypass file-based security scans.

Data is compressed, split into 10 MB chunks, and transmitted to a C2 server over unencrypted HTTP, with a watermark reading “SANTA STEALER” and a link to the Telegram channel. Subscriptions for the Premium plan can be as high as $300 per month.