SVCStealer

SVCStealer is a Windows information-stealing malware family first observed in early 2025 and implemented in C++. It is primarily associated with spearphishing attachment delivery and has also been observed as a secondary payload in broader criminal malware distribution chains involving loaders and other stealers. The malware is designed to harvest a wide range of victim data, including system and software inventory, browser-stored information, user credentials, cryptocurrency wallet data, screenshots, messaging application data, VPN-related data, running process information, and selected user files. Reported browser targeting includes Chromium-based and other mainstream Windows browsers, and messaging-app targeting includes platforms such as Discord, Telegram, and Tox.

On infected hosts, SVCStealer gathers data into a local working directory, compresses the collected material into an archive, and exfiltrates it to attacker-controlled command-and-control infrastructure over HTTP POST traffic intended to blend with normal web activity. It generates a host-specific victim identifier derived from the system volume serial number and repeatedly beacons to its command infrastructure for registration and tasking. Beyond data theft, SVCStealer can receive instructions to download and execute additional payloads, making it useful both as an infostealer and as a follow-on malware delivery component.

The malware employs basic defense-evasion and anti-analysis measures. Reported behaviors include terminating common monitoring or process-inspection tools, enforcing single-instance execution, and deleting collected artifacts and archives after exfiltration to reduce forensic visibility. Operational reporting has linked SVCStealer to malware-as-a-service style ecosystems and to campaigns overlapping with other commodity crimeware families, including StealC and Diamotrix, indicating use within broader financially motivated intrusion chains rather than attribution to a single exclusive actor or cluster.