DeerStealer Malware Deployed Through Exploitation of Windows Run Prompt by Threat Actors

The eSentire’s Threat Response Unit (TRU) has uncovered a series of malicious campaigns throughout May 2025, where threat actors have been deploying the DeerStealer malware, also known as XFiles Spyware, using the HijackLoader malware loader.

This sophisticated information stealer, peddled on dark-web forums by a user named “LuciferXfiles,” is designed to harvest a wide array of sensitive data, including cryptocurrency wallets, browser credentials, VPN details, and instant messenger information.

Attack Chain Targets User Credentials

The initial access method, dubbed ClickFix, manipulates victims into executing a malicious PowerShell command via the Windows Run Prompt, setting off a complex attack chain that ultimately delivers DeerStealer as the final payload.

This exploitation of a legitimate system feature underscores the evolving tactics of cybercriminals in bypassing traditional security measures.

The attack begins with a phishing redirection to a ClickFix page, tricking users into running an encoded PowerShell script that downloads a malicious Microsoft Installer (MSI) file, “now.msi,” using curl.exe.

According to the Report, this installer deploys files into C:\ProgramData and hijacks a legitimate, signed COMODO Internet Security binary to load a tampered, unsigned version of cmdres.dll.

Through a hooked C runtime (CRT) function, control flow is redirected to initiate the HijackLoader, which employs steganography to store encrypted configurations in PNG images.

The loader dynamically resolves APIs via hashed export names and decrypts subsequent stages from embedded files like Bairrout.xd, using custom scripts to automate analysis.

Eventually, DeerStealer is injected into processes via module stomping of legitimate binaries like input.dll, with configurations extracted from files such as Kleanmean.py.

Technical Breakdown of HijackLoader

DeerStealer itself is a robust threat, featuring control flow obfuscation, virtual machine-based string decryption, and encrypted HTTPS communication with command-and-control (C2) servers.

It fingerprints victim machines using unique identifiers like CPU names and registry data, packages stolen information into structured logs, and supports clipboard hijacking for over 14 cryptocurrency types.

Its browser harvesting capabilities target over 50 web browsers, alongside extensions for crypto wallets and password managers, while desktop applications like Discord, Telegram, FileZilla, and Steam are also in its crosshairs.

This malware’s subscription-based model, starting at $200 per month for the Premium tier and scaling to $3000 for Professional, offers threat actors advanced features like Hidden VNC for stealthy remote control, custom ClickFix scripts, and bypasses for Windows Defender and SmartScreen.

With planned expansions to support MacOS, AI integration, and automated crypto balance checking, DeerStealer poses a growing threat.

The use of legitimate tools and advanced obfuscation techniques highlights the need for heightened vigilance, robust endpoint protection, and user education to prevent falling prey to such socially engineered attacks that exploit system functionalities like the Windows Run Prompt.

As cybercriminals continue to refine their tools, staying ahead requires a proactive approach to detecting and mitigating these intricate threats before they compromise critical data.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates