Raven Stealer: A Stealthy New Threat in the Malware Ecosystem

Raven Stealer is a stealthy new entrant in the commodity malware ecosystem, designed as a lightweight information stealer targeting both individuals and enterprises, developed primarily in Delphi and C++. According to Point Wild’s analysis, it steals credentials, harvests browser data such as cookies, autofill entries and browsing history, and can perform real-time data exfiltration via Telegram bot integration.

The malware is distributed through underground forums and is frequently bundled with cracked software, and promoted via a dedicated Telegram channel, with a builder interface that embeds Telegram tokens and chat IDs into payloads. It emphasises evasion through randomised filenames, in-memory ChaCha20 decryption to avoid disk artefacts, and process hollowing into Chromium instances to disguise execution.

All stolen data is consolidated in a defined folder under %Local%\\RavenStealer, compressed into a ZIP archive and sent to the attacker via Telegram using the API endpoint. To defend against Raven Stealer and similar threats, Point Wild recommends avoiding pirated software, keeping antivirus and EDR updated, monitoring Telegram API traffic, and educating users about phishing and malware-laced downloads.