Bundled to Steal: The Salat Stealer Campaign

Salat Stealer is a malware written in Go that targets sensitive user data including browser credentials, cryptocurrency wallets, and communication platforms such as Discord and Steam. It performs deep system reconnaissance and supports advanced surveillance capabilities like desktop streaming and audio/video capture. The malware is distributed through campaigns bundling it with Xeno Executor, a gaming utility, thereby creating a full compromise vector. It employs multiple evasion techniques, including disabling Windows Defender features using PowerShell scripts, establishing persistence via registry run keys, and impersonating the lsass.exe token to gain elevated privileges. Loaders written in batch script and Rust further obfuscate the malware's deployment and help it bypass security controls. There is no known CVE or patch available, and no known exploits in the wild have been reported. The campaign and malware are documented by AlienVault and Splunk.

The malware can lead to significant data theft including browser credentials, cryptocurrency wallets, and communication platform data, potentially resulting in account compromise and financial loss. Its advanced surveillance capabilities allow attackers to monitor victims through desktop streaming and audio/video capture, increasing privacy violations. The use of evasion and persistence techniques complicates detection and removal, potentially allowing long-term unauthorized access and control over infected systems.

No official patch or fix is available as this is malware rather than a software vulnerability. Mitigation focuses on detection and prevention: avoid downloading or running untrusted software, especially gaming utilities like Xeno Executor from unofficial sources. Employ updated endpoint protection solutions capable of detecting PowerShell script abuses and suspicious token impersonation. Monitor for persistence mechanisms such as unusual registry run keys. Regularly update Windows Defender and other security tools to leverage latest detection capabilities. Since the malware disables Windows Defender features, consider layered security controls and behavioral monitoring to detect anomalous activities. Refer to vendor advisories and threat intelligence sources for updated detection signatures and indicators of compromise.