SALATSTEALER

SalatStealer is a Windows-focused Go-based malware-as-a-service infostealer that also incorporates substantial remote-access functionality. It has been described under the NyashTeam or WebRAT branding and has been observed in criminal distribution ecosystems as well as in targeted campaigns against Ukrainian entities. The malware is commonly packed or disguised to hinder analysis and uses encrypted configuration data, runtime decryption, and resilient command-and-control resolution mechanisms including DNS-over-HTTPS and, in newer variants, TON blockchain DNS. Communications have been observed over WebSocket secured with TLS, with QUIC or HTTP/3 support used for bulk data transfer.

Its core purpose is theft of high-value user data. SalatStealer targets credentials, cookies, browser databases, local state material, authentication tokens, and cryptocurrency wallet data from a wide range of Chromium- and Gecko-based browsers. It also targets browser extensions associated with digital-asset wallets, extracts data from messaging and gaming applications, and can collect clipboard contents relevant to cryptocurrency theft. Reported collection includes browser logins, session material, wallet artifacts, Telegram and Discord data, Steam-related data, screenshots, and other host-resident information suitable for account takeover and financial fraud.

Beyond classic infostealer behavior, SalatStealer includes RAT capabilities such as arbitrary command execution, interactive shell access, screen capture, desktop recording, webcam capture, microphone capture, keylogging, file download, process control, hidden desktop interaction, and SOCKS5 or peer-to-peer proxy functionality. These features enable both surveillance and broader post-compromise utility. Observed abuse of FFmpeg through the Windows DirectShow interface indicates support for covert multimedia device discovery and active video capture on infected hosts.

The malware employs multiple defensive and privilege-related techniques. Reported behaviors include adding Microsoft Defender exclusions, persistence through autorun mechanisms and scheduled tasks, COM-based elevation abuse to bypass browser protections, token manipulation, LSASS targeting, and anti-analysis measures such as misleading packer artifacts and runtime-obfuscated configuration. It has also been associated with process injection or hollowing in broader delivery chains and with self-deletion or cleanup behaviors.

Observed delivery has been diverse and strongly aligned with commodity cybercrime tradecraft. SalatStealer has been distributed via cracked software, game cheats, phishing and spearphishing campaigns, ClickFix-style lures, malicious archives containing executables or shortcuts, compromised websites, fake meeting-themed landing pages, and pay-per-install botnet ecosystems such as Amadey. It has also been linked to campaigns abusing GitHub-hosted payloads and to exploitation of CVE-2025-8088 in attacks impersonating Ukrainian government institutions.

Victim targeting spans broad criminal monetization as well as regionally focused operations. SalatStealer has been observed in campaigns targeting Ukrainian government institutions and Ukrainian-speaking organizations, while commodity distribution activity indicates wider global targeting of consumers and enterprises for credential theft, session hijacking, and cryptocurrency compromise. Its combination of infostealing, surveillance, and remote-access features makes it useful both as a standalone theft platform and as an enabling tool within larger intrusion chains.