Raven Stealer is a modern, lightweight information-stealing malware developed in Delphi and C++. It targets Chromium-based browsers to extract sensitive data, including passwords, cookies, and payment details. The malware uses a modular architecture and UPX packing to evade detection. It executes stealthily and exfiltrates data via Telegram bot integration. Distributed through GitHub and promoted on Telegram, Raven Stealer's user-friendly interface and dynamic module support make it attractive in the commodity malware ecosystem. The malware's capabilities include credential theft, browser data harvesting, and real-time exfiltration, posing a significant threat when used maliciously.
The Octalyn Forensic Toolkit, a publicly available GitHub project, presents itself as a research tool but functions as a sophisticated credential stealer. It consists of a C++ payload module and a Delphi-based builder interface, allowing even low-skilled actors to generate functional binaries. The toolkit extracts browser data, Discord and Telegram tokens, VPN configurations, gaming account data, and cryptocurrency wallet artifacts. It establishes persistence, organizes stolen data, and exfiltrates it via Telegram. The malware's modular design, ease of use, and active exfiltration capability pose significant risks if misused. It employs obfuscation techniques, Windows persistence methods, and structured data theft, demonstrating a deliberate effort to evade detection and maximize impact.
