Chihuahua Stealer Exploits Google Drive Document to Harvest Browser Login Credentials

A .NET-based infostealer named “Chihuahua Stealer” has been discovered using sophisticated techniques to infiltrate systems and exfiltrate sensitive data.

This malware, which blends common malware strategies with unusually advanced features, was first highlighted through a Reddit post where a user was tricked into executing an obfuscated PowerShell script via a Google Drive document.

Initial Vector and Execution Chain

The infection chain begins with a user being deceived into downloading what appears to be a legitimate document stored on Google Drive or OneDrive.

- Advertisement -

This document contains an embedded PowerShell script that, upon execution, initiates a multi-stage payload chain.

The first stage involves a short launcher that bypasses execution policies by running a Base64-encoded string silently through PowerShell’s iex command.

This setup is designed to evade immediate detection and allows attackers to embed the actual malicious logic in an encoded payload.

Subsequent stages involve fetching additional payloads from fallback command and control (C2) servers.

According to the Report, these payloads are dynamically downloaded and executed, showcasing the modular nature of the attack.

The script uses hex-string obfuscation and scheduled jobs for persistence, checking for custom marker files in the Recent folder and fetching further instructions from domains like cdn.findfakesnake.xyz.

Data Exfiltration and Stealth Techniques

Chihuahua Stealer targets browser data, including login credentials, cookies, autofill information, and browsing history, as well as crypto wallet extensions.

After harvesting this data, it’s compressed into an archive with a “.chihuahua” extension and encrypted using AES-GCM through Windows CNG APIs.

This encryption method, combined with the use of native Windows functions, adds a layer of complexity to the malware’s detection.

The final stage involves the encrypted data being exfiltrated over HTTPS, with the malware making efforts to erase local traces by clearing the console and clipboard contents.

This method of operation illustrates a deliberate attempt at stealth, ensuring the malware’s activities go unnoticed for as long as possible.

The Chihuahua Stealer’s approach, utilizing Google Drive as an initial infection vector, signifies a growing trend where legitimate services are misused for malicious purposes.

Its use of multi-stage payload delivery, scheduled task persistence, and advanced encryption methods highlights a significant challenge for cybersecurity professionals.

Indicators of Compromise:

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!