New Stealit Infostealer Abuses Node.js SEA Feature and Telegram C2 in Malware-as-a-Service Campaign

FortiGuard Labs has identified a new Stealit malware campaign that abuses the Node.js SEA feature to package and distribute its payloads, representing an evolution from its earlier Electron-based variants. The SEA approach lets Node-based applications run as a single executable binary without requiring a pre-installed Node.js runtime.

The campaign continues Stealit’s practice of masquerading as game or VPN installers, with malicious packages hosted on Mediafire and Discord, and the C2 panel has moved from stealituptaded[.]lol to iloveanimals[.]shop. Fortinet researchers noted that the Stealit website advertises subscription plans for Windows and Android stealers, priced around $500 for lifetime Windows access and $2,000 for Android, with a Telegram channel (@StealitPublic) for updates and customer support.

The infection chain starts with an installer component that executes obfuscated Node.js layers before delivering three core payloads—save_data.exe, stats_db.exe and game_cache.exe—downloaded from the C2 domain iloveanimals[.]shop, where save_data.exe extracts credentials from Chromium-based browsers and stats_db.exe targets browser, gaming client, messaging app and wallet data, while game_cache.exe acts as the C2 client to remotely execute commands and even deploy ransomware modules.

The campaign includes anti-analysis checks and anti-VM/sandbox measures, and FortiGuard Labs warned that this experimental SEA-based distribution enables operation without Node.js installed.