MalwarePublished 31 Jul 2025

MaaS Appeal: An Infostealer Rises From The Ashes

Source AlienVault OTX General

Description

NOVABLIGHT is a NodeJS-based Malware-as-a-Service (MaaS) information stealer developed by a French-speaking threat group. It's sold as an educational tool but used for credential theft and cryptowallet compromise. The malware features heavy obfuscation, multiple anti-analysis techniques, and various data exfiltration methods. It can disable Windows Defender, sabotage system recovery, and inject malicious code into popular Electron-based applications. NOVABLIGHT employs comprehensive system enumeration, captures screenshots and webcam footage, and steals passwords from various sources. The threat actors use Telegram and Discord for sales and support, with licenses valid for up to a year.

Impact

For European organizations, NOVABLIGHT poses a significant risk to confidentiality and integrity of sensitive information. Credential theft can lead to unauthorized access to corporate networks, email accounts, and cloud services, potentially resulting in data breaches and lateral movement within networks. The capability to compromise cryptocurrency wallets is particularly relevant for financial institutions, fintech companies, and any organization or individual involved in digital asset management. Disabling Windows Defender and sabotaging system recovery can prolong infection duration and complicate incident response efforts. The injection into Electron-based applications threatens a broad range of software commonly used in enterprise environments, increasing the attack surface. The malware’s ability to capture screenshots and webcam footage raises privacy concerns and could lead to espionage or blackmail. The MaaS distribution model lowers the barrier for cybercriminals to deploy this malware, potentially increasing infection rates across Europe. Organizations with remote or hybrid workforces using Electron apps or handling cryptocurrency are especially vulnerable. The threat could disrupt business operations, cause financial losses, and damage reputations if exploited successfully.

Defensive guidance

European organizations should implement targeted defenses against NOVABLIGHT by: 1) Enforcing strict application control policies to prevent unauthorized execution of NodeJS-based scripts and unknown Electron app modifications. 2) Employing advanced endpoint detection and response (EDR) solutions capable of detecting obfuscated malware behavior and anti-analysis techniques. 3) Regularly updating and hardening Windows Defender and system recovery options to prevent tampering. 4) Monitoring network traffic for connections to known malicious domains associated with NOVABLIGHT infrastructure and blocking them at the firewall or DNS level. 5) Conducting regular credential audits and enforcing multi-factor authentication (MFA) to reduce the impact of stolen credentials. 6) Educating users about phishing and social engineering tactics that may deliver the malware. 7) Restricting webcam and screenshot permissions for applications to minimize data leakage. 8) Implementing threat hunting activities focused on indicators of compromise such as the provided hashes and domains. 9) Isolating and monitoring Electron-based applications for suspicious code injections or abnormal behavior. 10) Collaborating with threat intelligence sharing platforms to stay updated on emerging variants and tactics related to NOVABLIGHT.

Indicators of compromise

Domains 5

nova-blight.site
nova-blight.xyz
api.nova-blight.top
bamboulacity.nova-blight.xyz
shadow.nova-blight.top

Hashes 3

39f09771d70e96c7b760b3b6a30a015ec5fb6a9dd5bc1e2e609ddf073c2c853d
97393c27195c58f8e4acc9312a4c36818fe78f2ddce7ccba47f77a5ca42eab65
ed164ee2eacad0eea9dc4fbe271ee2b2387b59929d73c843281a8d5e94c05d64

Yara 1

4b87f3e3dd91cf7dc9954cd729f8dec7a978c43c

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 31 Jul 2025, 20:33 UTC

MITRE ATT&CK techniques15 from threat tags

Technical details

Indicators of compromise

Domains 5

Hashes 3

Yara 1

Community reviews

Related threats