Lucid Stealer Uses Node.js SEA to Conceal Credential-Theft Payload

Aug 11, 2026 · Original article ↗

Summary

CYFIRMA details how Lucid Stealer hides encrypted payloads in Node.js SEA and harvests browser credentials, wallet data and Discord tokens. Observed WebSocket and HTTP upload attempts to lucidstealer[.]one failed with HTTP 403 responses.

Key points

The analyzed executable masquerades as the Node.js JavaScript Runtime and stores encrypted, fragmented payload components in its NODE_SEA_BLOB resource.
Structured data mimicking ASN.1/DER certificates misleads signature-based inspection and complicates static analysis.
PowerShell hides the console and requests elevation through a UAC prompt; an elevated instance launches only after user approval.
A native module renamed bridge_cfg.node supports browser-data extraction, DPAPI operations and screenshot capture; the malware terminates browser and Discord processes during harvesting.
Collected material includes browser passwords, cookies, payment information, cryptocurrency wallet files, Discord tokens and screenshots. A PowerShell keylogger polls keyboard state at 20-millisecond intervals.
Harvested data is packaged into a ZIP archive, but observed WebSocket, archive-upload and metadata requests received HTTP 403 responses; successful exfiltration was not observed.
The process repeatedly retries C2 connections but did not establish reboot persistence. An AsyncRAT executable in the C2 directory suggests possible shared infrastructure, not confirmed common attribution.

Article Details

Attack Vectors: Distribution as a disguised Node.js JavaScript Runtime executable that requires user execution.
Encrypted and obfuscated JavaScript payload embedded in a Node.js SEA container, with a malicious native module extracted and loaded at runtime.
PowerShell-based keylogging and native-module-assisted theft of browser credentials, Discord tokens, cryptocurrency wallet files, and screenshots.
HTTP POST and WebSocket communication for attempted transmission of collected data and system metadata.
Defensive Notes: Monitor Node.js executables running from temporary directories, especially when loading .node modules or launching PowerShell.
Detect suspicious Add-Type compilation, browser and Discord process termination, Hidden/System directory attributes, and repeated outbound WebSocket attempts.
Use application allowlisting to restrict executable and script execution from user-writable directories.
Restrict PowerShell and enable Script Block Logging, Module Logging, and transcription.
Apply least privilege and enforce UAC policies. Observed elevation required user approval of a UAC prompt; the detailed execution analysis does not demonstrate a prompt-free UAC bypass.
Observed WebSocket, archive upload, and metadata requests received HTTP 403 responses; successful exfiltration was not confirmed.
No reboot-surviving persistence mechanism was observed; the malware remained active until process termination or restart.
For suspected compromise, isolate hosts, rotate credentials, preserve forensic evidence, and hunt for associated indicators.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`lucidstealer[.]one`	Lucid Stealer C2 domain used for WebSocket communication and attempted data uploads.
IPV4	`104[.]21[.]8[.]179`	Reported A-record resolution of the Lucid Stealer C2 domain at analysis time.
IPV4	`172[.]67[.]157[.]161`	Reported A-record resolution of the Lucid Stealer C2 domain at analysis time.
IPV4	`85[.]239[.]155[.]68`	Listed by the report as a Lucid Stealer C2 IP address based on OSINT.
IPV4	`91[.]195[.]240[.]123`	Listed by the report as a Lucid Stealer C2 IP address based on OSINT.
MD5	`ddb14c1377a993e4b26a2f7c6d0388a1`	MD5 of the analyzed Lucid Stealer node.exe executable.
SHA256	`054ed7761c96210e31e3cae2a476cad18ba645ebc70b6c2e3cffdfe18cf6011a`	Analyzed Lucid Stealer executable named node.exe.
SHA256	`06edb1c24b98cd2c92f0e652ed4e4700d6a76f2299debed06f54c3ffa18ee5d9`	Nioxbaba.exe identified as AsyncRAT in the C2 server directory listing.
SHA256	`208a1acee4384809adc62dd358dfc5a547c55b3a0fdd8a5064cc779f929afece`	Malicious native module extracted as v20_native.node and renamed bridge_cfg.node.
SHA256	`cdba69887866a484276b35a818f5604047fb7369eec687af803752a6dcd0e885`	Dropped deps.zip archive containing the malware's native module.
URL	`hxxp[:]//lucidstealer[.]one/api/internal/log`	C2 endpoint for attempted transmission of victim and collection metadata as JSON; returned HTTP 403.
URL	`hxxp[:]//lucidstealer[.]one/api/upload`	C2 endpoint for attempted multipart HTTP POST upload of the harvested ZIP archive; returned HTTP 403.
URL	`hxxp[:]//lucidstealer[.]one/ws`	Reported C2 WebSocket endpoint; observed handshake attempts failed with HTTP 403.