New Rust-Based InfoStealer Uses Fake CAPTCHA to Deliver EDDIESTEALER

A newly discovered Rust-based infostealer, dubbed EDDIESTEALER, has been uncovered by Elastic Security Labs, spreading through a sophisticated social engineering tactic involving fake CAPTCHA verification pages.

Mimicking legitimate CAPTCHA systems like Google’s reCAPTCHA, these malicious prompts deceive users into executing harmful PowerShell scripts, ultimately deploying the infostealer on Windows systems to harvest sensitive data such as credentials, browser information, and cryptocurrency wallet details.

Deceptive Campaign Targets Unsuspecting Users

This campaign highlights a growing trend among cybercriminals to adopt Rust for malware development, leveraging the language’s modern features such as memory safety, zero-cost abstractions, and compiler optimizations for enhanced stealth and resistance to traditional threat detection engines.

The attack begins with users encountering a fake “I’m not a robot” verification screen on compromised websites, driven by an obfuscated React-based JavaScript payload.

According to Elastic Security Labs Report, this script copies a malicious PowerShell command to the clipboard using document.execCommand("copy"), instructing users to paste and execute it via the Windows Run dialog (Windows + R, Ctrl + V, Enter).

The command downloads a second-stage JavaScript payload, gverify.js, from an adversary-controlled domain (hxxps://llll.fit/version/), saving it to the user’s Downloads folder before executing it in a hidden window using cscript.

This script further retrieves the EDDIESTEALER executable from hxxps://llll.fit/io, storing it with a pseudorandom 12-character filename.

Upon execution, EDDIESTEALER, built in Rust, employs advanced obfuscation techniques like XOR-encrypted strings, custom WinAPI resolution mechanisms, and stripped function symbols, complicating static analysis.

Technical Deep Dive into EDDIESTEALER’s Execution Chain

It communicates with its command-and-control (C2) server via HTTP GET requests to fetch AES-encrypted configuration data, which includes a task list targeting specific data such as crypto wallets (e.g., Bitcoin, Exodus), browser information (e.g., Chrome, Firefox), password managers (e.g., Bitwarden), and messaging apps (e.g., Telegram).

The malware also features self-deletion capabilities using NTFS Alternate Data Streams renaming to evade detection and sandbox checks based on physical memory thresholds (above ~4GB).

Notably, newer variants show server-side anti-analysis tactics, withholding configurations if a sandbox environment is suspected, while employing hardcoded AES keys for communication and extensive function inlining to obscure control flow.

EDDIESTEALER’s Chromium-specific capabilities, inspired by tools like ChromeKatz, allow it to extract sensitive data by spawning off-screen browser instances or using Chrome’s DevTools Protocol to access decrypted credentials from memory, demonstrating a sophisticated approach to bypassing application-bound encryption protections.

This Rust-based threat underscores the evolving landscape of malware development, where modern programming languages are weaponized for greater resilience.

Indicators of Compromise (IOCs)

Observable	Type	Name/Value	Reference
47409e09afa05fcc9c9eff2c08baca3084d923c8d82159005dbae2029e1959d0	SHA-256	MvUlUwagHeZd.exe	EDDIESTEALER
e8942805238f1ead8304cfdcf3d6076fa0cdf57533a5fae36380074a90d642e4	SHA-256	g_verify.js	EDDIESTEALER loader
45.144.53[.]145	ipv4-addr	–	EDDIESTEALER C2
llll[.]fit	domain-name	–	EDDIESTEALER infrastructure

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!