Loading malware…
NOVABLIGHT is a NodeJS- and Electron-based Malware-as-a-Service (MaaS) information stealer. It is described as modular, heavily obfuscated, and feature-rich, with capabilities extending beyond credential theft. Reported functionality includes theft of login credentials, cryptocurrency wallet data, Chromium-based browser data, Wi-Fi passwords, screenshots, running process lists, antivirus details, clipboard contents, webcam video, and files matching sensitive keywords. It also includes a clipboard hijacker that replaces cryptocurrency or PayPal addresses with attacker-controlled values, and can inject malicious code into Electron applications such as Discord, Exodus, Mullvad VPN, Atomic Wallet, and Mailspring by unpacking and repacking ASAR files.
The malware performs anti-analysis and anti-debugging checks, including inspection of GPU names, usernames, VM drivers, screen resolution, USB presence, and remote GitHub-hosted blacklists, and can terminate known analysis and debugging tools based on a remotely hosted list. Additional sabotage and defense-evasion behavior reported for NOVABLIGHT includes attempts to disable Windows Defender via a downloaded batch file, disable Task Manager via the registry, repeatedly disable Wi-Fi and Ethernet adapters, disable the Windows Recovery Environment, delete Volume Shadow Copies, make its own executable undeletable with icacls, and remove the current user from local privileged groups.
NOVABLIGHT is sold as a MaaS offering through Telegram, Discord, and commercial storefronts, with customers purchasing time-limited API keys to generate malware builds via Telegram bot or Discord. Operators also provide a dashboard for viewing stolen victim data and support multiple exfiltration channels, including a proprietary panel, Telegram, Discord webhooks, and third-party file-hosting services such as bashupload, catbox, tmpfiles, oshi, sendfile, wsend, gofile, rdmfile, and bamboulacity.nova-blight[.]xyz/file/. Distribution has been observed through fake video game installers, including a lure site at gonefishe[.]com presenting a French-language game installer.
The operators are assessed in the cited reporting as likely being the French-speaking Sordeal Group, with links noted to Nova Sentinel and MALICORD. Mentioned NOVABLIGHT-related infrastructure includes api.nova-blight[.]top, shadow.nova-blight[.]top, nova-blight[.]site, nova-blight[.]xyz, and bamboulacity.nova-blight[.]xyz.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
NOVABLIGHT is a NodeJS-based Malware-as-a-Service (MaaS) information stealer developed and sold by a threat group that demonstrates French-language proficiency.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Before locking itself, it also executes a PowerShell command to remove the victim’s account from the following system groups: Administrators, Power Users, Remote Desktop Users, Administrateurs... captureAVDetails() ... Executes the PowerShell command Get-CimInstance... captureClipboardContent() ... Executes the PowerShell command Get-Clipboard
NOVABLIGHT is a modular and feature-rich information stealer built on NodeJS with the Electron framework... The script initializes a single large global array...
NOVABLIGHT can inject malicious code into several popular Electron-based applications... The injection implementation is a classic example of Electron App repacking: unpacking the ASAR file, rewriting any targeted source files, then repacking it... targeting applications such as: Discord client, Exodus wallet, Mullvad VPN client, Atomic wallet, Mailspring email client
NOVABLIGHT is a modular and feature-rich information stealer built on NodeJS with the Electron framework... incorporating methods for data collection and exfiltration, sandbox detection, and heavy obfuscation... The first technique to tackle is the malware’s use of array mapping... The second technique used to hide strings is the usage of base91 encoding... Access pattern obfuscation... Control flow obfuscation... Proxy variables...
NOVABLIGHT incorporates multiple techniques to detect and evade analysis environments... Detecting VM-related GPU names (vmware, virtualbox, qemu) ... Checking for blacklisted usernames ... Identifying VM-specific driver files ... Checking for low screen resolution and lack of USB devices ... Querying GitHub for blacklists of IPs, HWIDs, usernames, programs, organizations, GPU names, PC names, and Operating Systems
NOVABLIGHT can inject malicious code into several popular Electron-based applications... The injection implementation is a classic example of Electron App repacking: unpacking the ASAR file, rewriting any targeted source files, then repacking it... targeting applications such as: Discord client, Exodus wallet, Mullvad VPN client, Atomic wallet, Mailspring email client
captureTaskList() : Obtains a list of all currently running processes... Method: Executes the command tasklist /FO CSV /NH . Output: *configured_path*/TaskManagerInfo.txt
captureSystemInfo() : Gathers extensive hardware and software specifications to fingerprint the device. This includes the Hardware ID (HWID), CPU and GPU models, RAM size, disk information, Windows OS version, and a list of all connected USB devices.
getFilesUrgents : This functionality exfiltrate files on disk according to a set of keywords as follow: backup, default, code, discord, token, passw... wallet, crypto... these files are archived as files.zip then sent to the C2.
NOVABLIGHT incorporates multiple techniques to detect and evade analysis environments... Detecting VM-related GPU names (vmware, virtualbox, qemu) ... Checking for blacklisted usernames ... Identifying VM-specific driver files ... Checking for low screen resolution and lack of USB devices ... Querying GitHub for blacklists of IPs, HWIDs, usernames, programs, organizations, GPU names, PC names, and Operating Systems
Each module targets a specific piece of information, which is then saved to a local directory before being uploaded to the command-and-control server... these files are archived as files.zip then sent to the C2.
captureScreen() : Captures a full screenshot of the victim's desktop... Method: Utilizes the screenshot-desktop library.
captureClipboardContent() : Dumps the current content of the user's clipboard... Method: Executes the PowerShell command Get-Clipboard... The malware implements a "clipper" module that actively monitors the clipboard... and replaces them with addresses defined in the configuration
There are 3 channels for the stolen data: the official web panel owned by the NOVABLIGHT group, the Discord webhook API, and the Telegram API... the module falls back to communicating directly with the official Telegram API... Unlike the Telegram module, the Discord webhook implementation is much simpler. It utilizes a single URL for exfiltration
NOVABLIGHT employs a redundant and multi-tiered infrastructure... leverages a combination of legitimate third-party file-hosting services and its own dedicated backend. The following is the extracted list of domains and endpoints: https://bashupload[.]com ... https://gofile[.]io/uploadFiles ... https://rdmfile[.]eu/api/upload
The malware can sabotage system recovery by disabling the Windows Recovery Environment ( reagentc /disable ) and deleting all Volume Shadow Copies ( vssadmin delete shadows /all ) when the antireset flag is enabled in the configuration.
To disrupt the victim's internet connection, the malware employs two distinct methods. The first involves persistently disabling the Wi-Fi adapter... The second method disables the primary “Ethernet” network adapter using the netsh command, running it every 5 seconds to disable re-enabling attempts.
NOVABLIGHT attempts to disable Windows Defender and related Windows security features by downloading and executing a batch script... The malware claims to be capable of disabling the Task Manager... It uses setValues from the regedit-rs package to set the DisableTaskMgr value to 1... Actively killing known analysis and debugging tools found in a remote list
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modular Node.js/Electron-based information stealer targeting credentials and cryptocurrency wallets, with sandbox detection and obfuscation.
NOVABLIGHT is a Node.js-based infostealer offered as malware-as-a-service (MaaS), operated by French-speaking threat actors.
A modular NodeJS/Electron-based information stealer sold as MaaS. It steals credentials and browser data, captures screenshots, clipboard contents, webcam video, Wi-Fi passwords, and files, performs Electron app injections, substitutes crypto/PayPal clipboard addresses, exfiltrates data via web panel/Discord/Telegram, and includes anti-analysis, persistence, and system sabotage features such as disabling Defender, disrupting networking, and impairing recovery.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.