Marco Stealer Targets Browser Data, Crypto Wallets and Sensitive Files
Summary
Zscaler ThreatLabz analyzes Marco Stealer, an information-stealing malware first observed in June 2025 that targets browser data, cryptocurrency wallets, clipboard contents, screenshots, and sensitive local and cloud files.
Key points
- Marco Stealer profiles infected systems and collects browser data, cryptocurrency wallet information, clipboard contents, screenshots, and files from local folders and cloud services.
- A downloader uses an encrypted PowerShell command to retrieve and launch the malware.
- The malware uses encrypted strings and terminates processes associated with tools such as Wireshark, x64dbg, Process Hacker, and OllyDbg to hinder analysis.
- It extracts browser data using an injected DLL and a separate executable that communicates through a named pipe.
- Stolen data is generally encrypted with AES-256 and sent to command-and-control servers in HTTP POST requests; screenshots were observed being sent in plaintext.
- Zscaler reports that its Cloud Sandbox and security platform detect the campaign and lists associated indicators of compromise.
Article Details
- Attack Vectors
- A downloader decrypts strings to generate and execute a PowerShell command that downloads and launches Marco Stealer.
- Marco Stealer injects chromeDecryptor.dll into a headless Chromium-based browser process to retrieve browser encryption keys.
- The malware uses a named pipe to collect browser data from needMe.exe.
- The stealer collects browser credentials and data, cryptocurrency wallet information, clipboard contents, screenshots, and sensitive local or cloud-stored files, then sends stolen data to C2 servers using HTTP POST.
- Defensive Notes
- Monitor for PowerShell-launched downloads and execution of files from temporary directories.
- Monitor for processes that enumerate or terminate security-analysis tools and browser processes, inject DLLs into browser processes, or create the named pipe \\.\pipe\FirefoxBrowserExtractor.
- Inspect outbound HTTP POST traffic for the listed Marco Stealer C2 endpoints and the User-Agent value DataSender.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 028604d6aa556de2ae4ca6b31e600677 | Hash listed for a Marco Stealer artifact. |
| MD5 | 1042affb0ca6758ca0043112cdc7eda2 | Hash listed for a downloader artifact. |
| MD5 | 33dd8a5e234d911391cc8c301dc4a606 | Hash listed for a downloader artifact. |
| MD5 | 34deb6594098545d7ffb98844f0790bf | Hash listed for a ZIP artifact associated with the campaign. |
| MD5 | 3a3e8f6bc70748a39ffc047b3c86a665 | Hash listed for a ZIP artifact associated with the campaign. |
| MD5 | 49ab8d4c55b7f64eaba699ef0dc9054b | Hash listed for a Marco Stealer artifact. |
| MD5 | 5eb91d1ad26c7eced894e34710aaa28e | Hash listed for a ZIP artifact associated with the campaign. |
| MD5 | 661a5465d9a322276ebc414f39891a8b | Hash listed for a Marco Stealer artifact. |
| MD5 | a98fa5fba55e470750ae74186c15fa73 | Hash listed for a downloader artifact. |
| URL | hxxp[:]//217[.]156[.]50[.]228:8181/nujbOqrNYyLXXLmOhPpY/PNcWncSY[.]exe | Downloader command shown in the analysis uses this URL to retrieve and execute Marco Stealer. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware searches local directories for sensitive files and collects data from the victim’s system.T1012 · Query RegistryThe malware queries Windows registry locations for the machine GUID, antivirus products, installed software, and user data.T1041 · Exfiltration Over C2 ChannelMarco Stealer sends encrypted stolen data to its C2 server over HTTP.T1055.001 · Dynamic-link Library InjectionMarco Stealer injects chromeDecryptor.dll into a Chromium-based browser process.T1057 · Process DiscoveryThe malware enumerates running processes to identify browser processes and anti-analysis tools.T1059.001 · PowerShellThe downloader generates and executes a PowerShell command to download and launch the next-stage executable.T1071.001 · Web ProtocolsThe malware communicates with its C2 servers over HTTP.T1105 · Ingress Tool TransferThe downloader retrieves the Marco Stealer executable from a remote URL.T1113 · Screen CaptureMarco Stealer captures screenshots.T1115 · Clipboard DataMarco Stealer harvests clipboard contents.T1518.001 · Security Software DiscoveryThe malware enumerates installed antivirus products and software on the victim’s system.T1555.003 · Credentials from Web BrowsersThe malware retrieves browser encryption keys and collects browser data from Chromium-based browsers.T1562.001 · Disable or Modify ToolsMarco Stealer terminates processes associated with anti-analysis tools.
Malware
Vendors
Products
Basiliskby enumerating and terminating instances of various browsers, including lesser-known ones such as Basilisk, CLIQZ, and Pale Moon. After this process is complete, Marco Stealer extracts the previously mentionedCLIQZenumerating and terminating instances of various browsers, including lesser-known ones such as Basilisk, CLIQZ, and Pale Moon. After this process is complete, Marco Stealer extracts the previously mentioned needMe.exeDropboxtargets browser data, cryptocurrency wallet information, files from popular cloud services like Dropbox and Google Drive, and other sensitive files stored on the victim’s system. Marco Stealer implementsGoogle ChromeExfiltration via Chrome Appbound (chromeDecryptor.dll)Google Drivebrowser data, cryptocurrency wallet information, files from popular cloud services like Dropbox and Google Drive, and other sensitive files stored on the victim’s system. Marco Stealer implements severalMicrosoft OneDrive\OneDriveMozilla FirefoxC:\Users\\AppData\Roaming\Mozilla\Firefox\ProfilesPale Moonand terminating instances of various browsers, including lesser-known ones such as Basilisk, CLIQZ, and Pale Moon. After this process is complete, Marco Stealer extracts the previously mentioned needMe.exe executable. SlimBrowserC:\Users\\AppData\Roaming\FlashPeak\SlimBrowser\Profiles
Tools
OllyDbgcollected matches the name of a common anti-analysis tool such as x64dbg, Wireshark, Process Hacker, or OllyDbg, Marco Stealer terminates the corresponding process to evade analysis. Visit the Appendix section at theProcess Hackerthe information stealer uses Windows APIs to detect anti-analysis tools like Wireshark, x64dbg, and Process Hacker.Wiresharkanalysis. In addition, the information stealer uses Windows APIs to detect anti-analysis tools like Wireshark, x64dbg, and Process Hacker.x64dbgIn addition, the information stealer uses Windows APIs to detect anti-analysis tools like Wireshark, x64dbg, and Process Hacker.