LTX Stealer

"hosting payloads on trusted cloud services such as Google Drive and OneDrive"; "retrieve next-stage shellcode payloads... hosted on trusted platforms like Cloudflare Pages, Netlify, and Discord"; "Cloudflare is leveraged to front backend services and mask infrastructure details"

Initial Access T1189 Drive-by Compromise

Execution T1059.001 Command and Scripting Interpreter: PowerShell

The installer contents revealed an unusually large, embedded archive containing 5,888 files, of which 5,881 were encrypted.

The payload was built using pkg, which bundles JavaScript code, application dependencies, and the Node.js runtime into a single executable.

LTX Stealer follows this pattern by leveraging Inno Setup as its initial delivery mechanism, embedding encrypted payloads that are only decrypted at runtime.

"The infection begins with a file named Negro.exe, which presents itself as a standard Windows application. However, under the hood, it is a Trojan horse. The malware utilizes Inno Setup... to blend in with legitimate software distribution workflows."

"Once executed, the malware drops a payload named updater.exe into a hidden system directory."

T1564.003 Hide Artifacts: Hidden Window

"...allowing it to recover saved passwords, cookies, and active session tokens."

"LTX Stealer... conducts large-scale credential harvesting from Chromium-based browsers, targets cryptocurrency-related artifacts..."; "Marco Stealer... targets browser data, cryptocurrency wallet information..."

“Once inside, LTX Stealer targets Chromium-based browsers... accesses the ‘Local State’ files to extract encryption keys... used to unlock saved passwords and session cookies.”

All collected cryptocurrency artifacts are aggregated alongside browser credentials, screenshots, and system information.

The malware collects cryptocurrency-related artifacts by searching for wallet files and browser-based wallet extension data.

Discovery T1087 Account Discovery

For Microsoft Edge, the malware repeatedly accessed: C:\Users\<User>\AppData\Local\Microsoft\Edge\User Data\Local State

Harvested items may include wallet configurations, cached credentials, and other sensitive financial information, which are aggregated and prepared for exfiltration.

“...and takes screenshots of the user’s activity.”

“All stolen data is compressed and prepared for exfiltration to a command-and-control server.”

"The malware connects to a backend infrastructure powered by Supabase and fronted by Cloudflare, mimicking a professional SaaS application."

Command and control T1071.004 Application Layer Protocol: DNS

“The attackers utilize cloud services like Supabase for authentication and Cloudflare to hide their server’s true location...”

"The payload was built using pkg, which bundles JavaScript code, application dependencies, and the Node.js runtime into a single executable."

The data is subsequently compressed into archive files in preparation for exfiltration to attacker-controlled backend infrastructure.

Impact T1485 Data Destruction