New Maranhão Stealer Targets Users Through Pirated Software and Cloud Services

A new information-stealing campaign named Maranhão Stealer has emerged, targeting gaming enthusiasts who download pirated software distributed via cloud-hosted platforms. The campaign, first identified by security researchers in May 2025, represents a notable shift in credential theft by combining social engineering with advanced evasion techniques, according to cyble[.]com.

It is developed using Node.js and is packaged in Inno Setup installers to help masquerade as legitimate software, with the malware’s persistence achieved by a deceptive directory named “Microsoft Updater” and a hidden system attribute. After installation, updater.exe creates a Run registry entry to ensure execution from the _Microsoft Updater_ directory and is capable of exfiltrating stored credentials, browsing history, cookies, and session tokens from Chrome, Edge, Firefox, Brave and Opera.

The stealer also targets cryptocurrency wallets including Electrum, Atomic Wallet, Exodus, Coinomi and Mercury Wallet, sending victim details to multiple API endpoints hosted on maranhaogang[.]fun. To spread, the campaign relies on convincing gaming tool and cracked software sites, leveraging users’ tendency to disable security software during unofficial installations.