Stealit Malware Abuses Node.js Single Executable Feature via Game and VPN Installers

Stealit is an active malware campaign that has exploited Node.js’ Single Executable Application feature to distribute its payloads, with Fortinet FortiGuard Labs noting that SEA allows Node.js apps to run as a standalone executable without a Node.js runtime. According to Fortinet FortiGuard Labs, some campaigns have also used the Electron framework to deliver the malware and it is being spread through counterfeit installers for games and VPN apps uploaded to file‑sharing sites such as Mediafire and Discord.

The attackers’ site claims to offer “professional data extraction solutions,” including a remote access trojan capable of file extraction, webcam control, live screen monitoring and ransomware deployment for Android and Windows. Prices for the Windows Stealer range from $29.99 weekly to $499.99 for a lifetime licence, while Android RAT pricing runs from $99.99 to $1,999.99.

The fake installers encapsulate a main component downloader from a command-and-control server and perform anti-analysis checks; they also write a Base64 authentication key to the temp cache file to authenticate with the C2.