Salat Stealer: A New Go-Based MaaS Is Hijacking Browsers and Crypto Wallets

Salat Stealer is described by CYFIRMA as a sophisticated Go-based infostealer targeting Windows systems, operated under a Malware-as-a-Service (MaaS) model. According to CYFIRMA, the malware exfiltrates browser credentials, cryptocurrency wallet data, and session information while employing evasion techniques such as UPX packing, process masquerading, registry run keys, and scheduled tasks.

The threat is linked to Russian-speaking operators connected to NyashTeam and Kapchenka, who commercialise the tool through structured MaaS offerings, with pricing that includes monthly WebRat subscriptions from 1,199 rubles and hosting services at 999 rubles for two months.

It targets data sources including multiple web browsers, cryptocurrency wallets and browser wallet extensions, as well as Telegram sessions and Steam, with a control panel called WebRat that supports real-time attacker interaction via WebSockets and remote PowerShell execution.

The stealer communicates with its C2 via UDP and encrypted HTTPS to salat[.]cn/sa1at, a domain flagged as suspected phishing, and fallback domains such as webrat[.]in, webrat[.]ru, webrat[.]su, and posholnahuy[.]ru are in place to maintain continuity.