Next-Gen Threat: Xillen Stealer v4 Targets 100+ Browsers/70+ Wallets with Polymorphic Evasion and DevOps Theft

Darktrace notes that Xillen Stealer v4/v5 significantly broadens its targets, claiming to steal from 100+ browsers and 70+ cryptocurrency wallets, along with passwords managers, developer environments, cloud credentials, containers and DevOps systems, and SSO tokens.

According to Darktrace, the threat features a Rust-based polymorphic engine and a PolymorphicEngine that uses randomized instruction patterns, control flow obfuscation, and non-functional code to increase variability, with additional string encryption and a stub-based packer.

The malware also includes a DevToolsCollector to gather data from IDE configurations, cloud credentials, Docker/Kubernetes configs, Git credentials and API keys, broadening its potential impact to DevOps and software teams as well as cloud administrators. It employs multiple steganographic methods, such as LSB image encoding, NTFS Alternate Data Streams, Registry-based hiding and other techniques to conceal stolen data, and uses a CloudProxy module to exfiltrate via cloud service domains.

Darktrace highlights an AI Target Detection module that relies on rule-based pattern matching rather than real machine learning, and notes that the C2 system supports multiple channels, including Tor, I2P and IPFS, with domain generation algorithms for dynamic .onion addresses.