Anivia Stealer Peddled on Dark Web with UAC Bypass

A newly advertised information-stealing malware called Anivia Stealer has surfaced on the dark web, with threat actor ZeroTrace aggressively promoting the C++17-based infostealer as a commercial malware-as-a-service offering. The malware implements privilege escalation with automatic UAC bypass functionality and operates as a standalone executable, reportedly able to run across Windows environments from legacy XP to Windows 11.

It targets browser-stored credentials, cryptocurrency wallet information, system authentication tokens, and Local Security Authority credentials, and it also retrieves WhatsApp data and can capture screenshots, with encrypted communication to its command-and-control infrastructure.

According to promotional materials shared by ZeroTrace, the tool’s web-based admin panel includes geolocation mapping to monitor infections in real time, and pricing is structured on a subscription model, with a one-month license for €120 and other options up to €680 for lifetime access. The reporting suggests a link to earlier malware variants such as ZeroTrace Stealer and Raven Stealer, implying a rebranding or fork of existing code.

Mitigations call for enhanced EDR monitoring for UAC bypass attempts, application whitelisting, current patches, and cautious handling of email attachments and suspicious links.