Mars Stealer Looking for Clients on Hacking Forums
A revamped version of one of 2021' infamous information stealer has appeared on the Internet – the Mars Stealer. This successor of the Oski Stealer appears to pack new and improved features, which allow it to cause much more trouble for its victims. In addition to the typically stolen data like Web browser logins and credentials, the Mars Stealer is also able to exfiltrate cryptocurrency wallets, and even to break through two-factor authentication.
The curious thing is that the Mars Stealer is not a private project. Instead of using it for their own evil deeds, the creators are promoting it on hacking forums, and selling access to customers. Such malware-as-a-service schemes are a common thing nowadays and, unfortunately, they often result in devastating attack campaigns. The Mars Stealer could be used by hundreds of cybercriminals operating in different parts of the world, greatly enhancing this malware's reach. The good news is that this also means that antivirus product vendors have plenty of samples to work with, enabling them to easily mitigate Mars Stealer attacks.
Currently, most Mars Stealer ads target Russian-speaking criminals, but it would not be a surprise if we see English promotions soon, According to the advertisements, the Mars Stealer is capable of:
- Stealing data from over 30 Web browsers, mail clients, FTP clients, and other Web apps.
- Hijack information from two-factor authentication applications.
- Steal information from cryptocurrency wallets and wallet extensions.
The infostealer is incredibly small in size, slightly under 100KB. This makes it easy for its operators to pack it into other executable files, archives, and similar content. Many of them might also rely on macro-laced documents to plant the Mars Stealer. The best way to stay safe from the Mars Stealer attack is to protect your system with an up-to-date antivirus software suite.
