FadeStealer

FadeStealer is a ScarCruft-linked malware family used for data exfiltration. The provided content describes it as a previously documented stealer associated with the North Korean state-sponsored APT group ScarCruft, including activity attributed by S2W TALON to ChinopuNK, a ScarCruft subgroup. In the reported campaign targeting South Korean users, the infection chain used a malicious LNK file embedded in a RAR archive themed as a postal-code update notice. Execution of the LNK dropped an AutoIt loader, which retrieved additional payloads from an external server, including FadeStealer alongside other malware such as NubSpy, LightPeek, VCD Ransomware, and CHILLYCHINO. FadeStealer is explicitly described as supporting data exfiltration and as collecting keylogging data, screenshots, audio, device information, and file data. The campaign context ties it to spearphishing-style delivery and Windows host compromise. High-confidence associations in the content link FadeStealer to APT37/ScarCruft operations and targeting of South Korean users.