Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns
Essential information
- Published
- 29/05/2025 19:24
- Modified
- 29/05/2025 19:42
- Tags
- 2025-05-29 captcha cryptocurrency data exfiltration eddiestealer infostealer powershell rust
- Related entities
- 27 observables, 12 techniques (mitre), 1 malware
Description
A novel Rust-based infostealer called EDDIESTEALER has been discovered, distributed through fake CAPTCHA campaigns. The malware uses deceptive verification pages to trick users into executing a malicious PowerShell script, which deploys the infostealer. EDDIESTEALER targets sensitive data including credentials, browser information, and cryptocurrency wallet details. It communicates with a command and control server to receive tasks and exfiltrate data. The malware employs string obfuscation, API obfuscation, and other evasion techniques. It specifically targets various crypto wallets, browsers, password managers, FTP clients, and messaging applications. The use of Rust in its development reflects a growing trend among threat actors seeking enhanced stealth and resilience against traditional analysis methods.