New Mystic Stealer malware increasingly used in attacks

[MuzzMelbourne]

Content source

https://www.bleepingcomputer.com/news/security/new-mystic-stealer-malware-increasingly-used-in-attacks/

A new information-stealing malware named 'Mystic Stealer,' has been promoted on hacking forums and darknet markets since April 2023, quickly gaining traction in the cybercrime community.

The malware, rented for $150/month, targets 40 web browsers, 70 browser extensions, 21 cryptocurrency applications, 9 MFA and password management applications, 55 cryptocurrency browser extensions, Steam and Telegram credentials, and more.

Two individual reports on Mystic Stealer, published almost simultaneously by Zscaler and Cyfirma, warn about the emergence of the new malware, its sophistication, and what appears to be a surge in sales that brings many new campaigns online.

New Mystic Stealer malware increasingly used in attacks

A new information-stealing malware named 'Mystic Stealer,' has been promoted on hacking forums and darknet markets since April 2023, quickly gaining traction in the cybercrime community.

www.bleepingcomputer.com

 

[HarborFront]

Didn't know got so many browsers...........many unheard of

Targeted web browsers​

• Opera
• K-Meleon
• Mozilla icecat
• Mozilla Firefox
• Comodo IceDragon
• 8pecxstudios Cyberfox
• NETGATE Technologies BlackHawk
• Torch
• Chedot
• Kometa
• liebao
• Comodo
• Iridium
• Vivaldi
• Orbitum
• K-Melon
• Chromium
• QIP Surf
• Maxthon3
• Nichrome
• Chromodo
• Amigo
• 7Star
• CentBrowser
• Mail.Ru Atom
• Google Chrome
• Coowon
• uCozMedia Uran
• CocCoc Browser
• Microsoft Edge
• Sputnik
• Elements Browser
• 360Browser
• Epic Privacy Browser
• CatalinaGroup Citrio
• YandexBrowser
• MapleStudio ChromePlus
• Brave-Browser
• Fenrir Inc Sleipnir5 ChromiumViewer

Luckily, my Ungoogled Chromium is not on the list. Librewolf amd Mullvad browsers also not on the list.

I think the malware developer is using Ungoogled Chromium browser.

 

[oldschool]

Luckily, my Ungoogled Chromium is not on the list. Librewolf amd Mullvad browser also not on the list.

I don't know about Mullvad but your Ungoogled Chromium is on the list because it's still Chromium. The "Ungoogled" part is irrelevant.

70 browser extensions, ... 9 MFA and password management applications

@Wladimir Palant's warnings about these are well heeded, making my Little Black Book the safest bet. The tradeoff is less convenience for more peace of mind, and I'm fine with that.

 

[HarborFront]

I don't know about Mullvad but your Ungoogled Chromium is on the list because it's still Chromium. The "Ungoogled" part is irrelevant.

@Wladimir Palant's warnings about these are well heeded, making my Little Black Book the safest bet. The tradeoff is less convenience for more peace of mind, and I'm fine with that.

There are chromium browsers affected like Brave, MS Edge, Iridium, Yandex, Cent, Epic and Chromium

No mention of Ungoogled Chromium.

Like FF-based browsers Librewolf and Mullvad browsers not affected although some FF-based browsers are affected

No mention means not counted

 

[[correlate]]

A new information-stealing malware called Mystic Stealer has been found to steal data from about 40 different web browsers and over 70 web browser extensions.
First advertised on April 25, 2023, for $150 per month, the malware also targets cryptocurrency wallets, Steam, and Telegram, and employs extensive mechanisms to resist analysis.

New Mystic Stealer Malware Targets 40 Web Browsers and 70 Browser Extensions

A new information-stealing malware called Mystic Stealer is targeting 40 web browsers and 70 browser extensions, as well as cryptocurrency wallets.

thehackernews.com

 

[Captain Holly]

No mention of Avast or AVG browsers, but I guess those could be targeted anyway. Both are based on Chromium with a few extra Avast/AVG security features added in. I have been using Avast Free AV and the Avast Secure Browser on my Windows 11 laptop for the last few weeks now. They work very well together and I have yet to see the first upsell scareware notice from the Avast AV.

C.H.

 

[MuzzMelbourne]

New Information Stealer 'Mystic Stealer' Rising to Fame

A new information stealer malware named Mystic Stealer is gaining traction among cybercriminals on prominent underground forums.

www.securityweek.com

 

[ebocious]

@cruelsister Have you seen this? I'm wondering how CFW fares against it: https://app.any.run/tasks/f1525550-3fdc-42ca-a8ec-39acfcdd9896/

 

[Sandbox Breaker]

Posted sample here while back. Malware Analysis - Mystic Stealer Bypassing Sandboxes

 

[Sandbox Breaker]

@cruelsister Have you seen this? I'm wondering how CFW fares against it: Analysis 7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc.exe (MD5: 2438343A7BA217B87B3BFBDDAF8A99F9) No threats detected - Interactive analysis ANY.RUN

I confirm it will and does block this varients. Unless it's a supply chain attack

 

[cruelsister]

@cruelsister Have you seen this? I'm wondering how CFW fares against it: Analysis 7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc.exe (MD5: 2438343A7BA217B87B3BFBDDAF8A99F9) No threats detected - Interactive analysis ANY.RUN

This guy has been around for a while now. I did test various samples (perhaps a dozen over a few months) of it against CF without noting any issues. Annoyingly some samples were VM aware (Vbox) and some, although supposedly being able to steal, were coded to call home if various things were detected running on the system, cis.exe being among them.

Perhaps due to the above in no sample that I had access to did I note any browser data being pilfered nor were any Outbound connections to anywhere noted (and a stealer without being able to transmit stolen data out is really just junk).

 

[ebocious]

Posted sample here while back. Malware Analysis - Mystic Stealer Bypassing Sandboxes

Yes. It was because of this very thread that I was wondering about it, when I saw someone trashing Comodo's developers because they don't publish malware analyses. But Comodo (Xcitium) has said they care more about prevention than detection, as a single breach can cost millions. Of course, I know detection is important, particularly when installing software from unknown sources. That, and knowing not to say yes to a UAC prompt when opening a document.

 

[Brahman]

particularly when installing software from unknown sources

Why do someone want to install software from unknown sources, except in a Vm? That's like wearing helmet and riding a Hayabusa to the redline in a heavily trafficked road and hoping that helmet will save you.