Raven Stealer Targets Google Chrome Users to Exfiltrate Sensitive Data

Raven Stealer is described as a sophisticated information‑stealing malware that targets Google Chrome and other Chromium‑based browsers, including Edge and Brave. It harvests passwords, cookies, payment data, and autofill entries from infected systems, accessing local storage paths and credential vaults to retrieve login credentials for potential account compromise.

The malware can decrypt sensitive browser data by accessing AES keys stored in browsers’ Local State files, converting encrypted credentials into plain text for theft. It uses a modular Delphi/C++ build with a built‑in resource editor and embeds Telegram bot tokens for real‑time data exfiltration and potential C2‑like capabilities, enabling data to be sent to attackers via Telegram.

Its execution relies on in‑memory techniques such as ChaCha20‑encrypted payloads and reflective process hollowing to inject into new Chromium processes, allowing operation without writing decrypted code to disk. Distribution occurs through underground forums and cracked software, and the activity has been linked to a threat ecosystem that promotes the tools via dedicated Telegram channels, according to Point Wild Threat Intelligence.