Xillen Stealer Updates to Version 5 to Evade AI Detection

Darktrace reports that Xillen Stealer has released versions 4 and 5, expanding its cross‑platform infostealer capabilities to target credentials, cryptocurrency wallets, system information and account data from a range of stores, browsers (over 100) and password managers, with features such as persistence, encryption, polymorphism and a P2P C2 channel.

The malware includes anti‑analysis techniques and an AI evasion module called AIEvasionEngine, which mimics legitimate user activity, injects noise and randomises execution patterns to confuse detectors. A Polymorphic Engine within a Rust‑based component performs obfuscation, control‑flow changes and dead code insertion to vary output and hinder detection.

Collectors such as DevToolsCollector, BiometricCollector and PasswordManagerCollector target Kubernetes, cloud credentials, SSH keys, VPN configs and browser/password manager data, while SSOCollector, TOTPCollector and EnterpriseCollector extend data theft to tokens, TOTPs and enterprise credentials on Windows. Exfiltration relies on CloudProxy for cloud‑based transmission and P2PEngine for diverse C2 paths, including potential use of blockchain, Tor/I2P and IPFS, with final reports sent to a Telegram account. The update was detailed in the 20 November 2025 publication.