A newly analyzed Python-based information stealer named SolyxImmortal is actively targeting sensitive user data, including browser credentials, cookies, documents, screenshots, and keystrokes.
The malware uses common Python libraries and multi-threading techniques to run multiple surveillance and data theft operations simultaneously, making it efficient and difficult to detect during execution.
Security researchers, including Cyfirma, report that the malware primarily targets Turkish users and exfiltrates stolen data through Discord webhooks.
The analyzed sample, identified with SHA256 hash 5a1b440861ef652cc207158e7e129f0b3a22ed5ef5d2ea5968e1d9eff33017bc, is a relatively small Python script of just over 10 KB.
Despite its size, it contains extensive functionality by importing multiple built-in and third-party Python modules. These modules allow the malware to interact with the operating system, extract browser data, capture screenshots, log keystrokes, and communicate with remote servers.
Once executed, SolyxImmortal establishes persistence on the infected system by copying itself into the %APPDATA%\WindowsGraphics directory and creating a registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
This ensures the malware executes every time the user logs in. After a short delay, the malware launches multiple threads to begin data collection activities in parallel.
One of its core functions involves extracting saved credentials from Chromium-based browsers such as Chrome, Edge, and others. The malware accesses browser databases, retrieves encrypted credentials, and uses Windows cryptographic APIs to decrypt stored passwords.
These credentials are formatted and saved locally in a file named “sifreler.txt,” which translates to “passwords” in Turkish. In addition, it collects cookies from Firefox by copying cookie database files from user profiles.
SolyxImmortal Malware
Pulsedive said in a report shared with GBhackers, the malware also searches the victim’s system for sensitive documents. It recursively scans directories starting from the user’s home folder while skipping system-related paths.
Only specific file types such as .txt, .pdf, .docx, and .xlsx are targeted, and only if their size falls between 100 bytes and 10 MB. Collected files are staged in a temporary folder before being compressed into an archive for exfiltration.
SolyxImmortal includes a keylogging component that records every keystroke entered by the user. The captured data is temporarily stored in a buffer and sent to attacker-controlled infrastructure every 60 seconds in JSON format.
This allows continuous monitoring of user activity, including login credentials and private communications.
Another notable capability is its screenshot functionality. The malware captures screenshots at regular intervals and also when specific keywords appear in active window titles.
These keywords include terms related to banking and login pages, many of which are in Turkish. When triggered, screenshots are immediately captured and exfiltrated, indicating a focus on credential harvesting.
All collected data, including files, screenshots, and keystrokes, is exfiltrated via Discord webhooks. This method allows attackers to blend malicious traffic with legitimate services, making detection more challenging.
Messages used during exfiltration contain Turkish phrases, further suggesting that the campaign is tailored toward Turkish-speaking victims.
The goal of the start function is to establish persistence, delay execution for 15 seconds after persistence is achieved, and then create threads to collect information.
SolyxImmortal demonstrates how threat actors continue to leverage simple scripting languages like Python to build effective and modular malware.
Its use of legitimate libraries, multi-threading, and trusted platforms like Discord highlights a growing trend of stealthy and adaptable information stealers.
Organizations and users should monitor unusual outbound connections, restrict script execution where possible, and deploy endpoint detection solutions to mitigate such threats.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
