Updated Xillen Stealer expands targeting, bolsters stealth

More environments could be covertly targeted by versions 4 and 5 of the Python-based XillenStealer malware, which has been strengthened to become an extensive data harvesting platform, reports GBHackers News.

Updated iterations of XillenStealer enabled not only the exfiltration of password manager credentials, social media accounts, and stored data across over 100 web browsers but also theft of cryptocurrency across over 70 wallets on top of targeting Internet of Things devices, Docker instances, and Kubernetes configurations, findings from a Darktrace analysis revealed.

Multiple functions allow XillenStealer to pilfer IDE configuration data, cloud credentials, SSH and API keys, biometric configuration data, enterprise credentials, time-based one-time passwords, and Azure Active Directory and Kerberos single sign-on tokens.

Moreover, XillenStealer, which also uses artificial intelligence for target discovery, has also been integrated with the new AIEvasionEngine module that copies user and system behavior to circumvent AI-based and behavior-based detection tools, according to researchers.