Xenon Stealer
Xenon Stealer is the name of a malicious application being distributed on underground hacking forums. Any budding hacker can purchase the malware for as little as a hundred dollars and then find ways to deliver it to their victims.
Xenon Stealer, as its given name suggests, is a data stealing malware. This means that it can harvest a wide range of information stored on the victim's computer and transfer it to the bad actor operating the malware. Xenon Stealer has the capability to steal form auto-fill information, download history and cookies from a number of popular browsers.
VPN information is also scraped from the infected system, as well as clipboard contents and instant messaging service sessions. The stealer also has the ability to exfiltrate files from the victim's computer.
Another function that the malware has is intercepting cryptocurrency wallet strings found in the clipboard and silently replacing them with a wallet string that belongs to the hacker operating the malware. This means that users can make cryptocurrency transfers right to the criminals' wallets without even suspecting something is wrong.
Xenon Stealer has the ability to intercept and replace wallet strings for a number of popular cryptocurrencies such as Bytecoin, Electrum, Ethereum and Monero.
Finally, the malware also has the ability to take screenshots of the user's desktop and screen and send those back to the hackers, as well as log keyboard strokes, which makes entering any login information extremely dangerous.
As with a lot of other malware, Xenon Stealer is spread primarily using malicious spam email campaigns that have dangerous attachments. This is why it is always a good practice to never open attachments in any email where you don't personally know the sender and cannot identify the reason you received the email with complete certainty.
A lot of the time malware authors and hackers distributing the payloads resort to social engineering tricks, giving the malicious emails titles that suggest urgency or mimicking legitimate organizations, which lends a fake layer of credibility to the messages. This is where users should be particularly careful.
Keeping an up-to-date anti-malware suite on your system is always a good idea, as a lot of dangerous malware similar to the Xenon Stealer will usually get intercepted by the anti-malware before it gets a chance to deploy and do any real harm.
