Novel Raven Stealer malware enables covert browser data compromise

Hackread reports that web browsers, including Google Chrome and Microsoft Edge, could have their stored personal information stealthily pilfered by the newly emergent Raven Stealer malware.

Attackers have primarily used pirated software on underground forums to distribute an obfuscated Delphi- and C++-based Raven Stealer payload, which facilitates real-time gathering of browser-stored credentials, cookies, and payment details in a ZIP folder before subsequent exfiltration to an attacker-controlled server via Telegram chatbot, according to findings from Point Wild's Lat61 Threat Intelligence Team.

Data compromise conducted by the information-stealing payload has been concealed from antivirus programs with the use of process hollowing, researchers added.

Raven Stealer's emergence indicates the evolution of commodity malware and is "a reminder that attackers are packaging advanced techniques into tools that even low-skilled actors can use," noted Point Wild Chief Technology Officer and Lat61 Threat Intelligence Team Head Dr. Zulfikar Ramzan.