Shuyal Stealer Malware Exploits 19 Browsers to Steal Logins

Shuyal Stealer is described as a recently uncovered infostealer that expands beyond the usual Chrome and Edge targets by compromising 19 browsers, including Chrome, Edge, Tor, Brave, Opera, Opera GX, Yandex, Vivaldi, Chromium, Waterfox, Epic, Comodo, Slimjet, Coc Coc, Maxthon, 360 Browser, Falkon, and two lesser-known variants.

It performs deep system reconnaissance, collecting details about disk drives, input peripherals, display configurations, and also captures screenshots and clipboard contents, while adding Discord tokens to its haul and exfiltrating everything through a Telegram bot infrastructure.

The malware is delivered as a 64-bit C++ executable compiled into an obfuscated binary, with integrity hashes MD5: 9523086ab1c3ab505f3dfd170672af1e and SHA-256: 8bbeafcc91a43936ae8a91de31795842cd93d2d8be3f72ce5c6ed27a08cdc092, and it uses Windows Management Instrumentation commands to gather hardware fingerprints. Credential harvesting begins with a targeted SQL query against browser-stored SQLite databases: SELECT origin_url, username_value, password_value FROM logins.

In infection, a malicious executable stages data in a runtime directory, a PowerShell script compresses it to runtime[.]zip and exfiltrates via Telegram’s Bot API using a hardcoded bot token and chat ID, before a batch file self-deletes traces.

Evasion includes stopping taskmgr.exe and setting DisableTaskMgr to 1, and persistence is achieved by silently copying itself into the Windows Startup folder using CopyFileA. according to GBHackers On Security, defenders should emphasise vigilance, patching, and behaviour-based controls, with Safe Mode remediation and a remedy such as UltraAV identifying the threat as Trojan.W64.100925.Shuyal[.]YR.