New Stealit Malware Exploits Node.js Extensions to Target Windows Systems

Security researchers have identified an active Stealit malware campaign that uses an experimental Node.js feature to infect Windows systems, according to FortiGuard Labs. The operators are leveraging Node.js’s Single Executable Application functionality to package and distribute malicious payloads, a shift from earlier Stealit versions that relied on Electron.

The campaign distributes installers via file-sharing platforms such as Mediafire and Discord, disguised as popular games and VPN software, with a Visual Basic script used to establish persistence on compromised machines. Stealit is marketed as a Malware-as-a-Service operation, offering a Windows lifetime license for about $500 and an Android variant for around $2,000, and promoting a range of RAT capabilities including remote file access, webcam hijacking, live screen monitoring, and ransomware deployment.

The group also promotes the service through a public Telegram channel, presenting it as a professional cybercrime operation. Sophisticated anti-analysis techniques and multi-stage in-memory execution help Stealit avoid detection, while its data theft modules exfiltrate credentials and other sensitive data from Chromium-based browsers and various apps and wallets. October 11, 2025.