Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

Summary: Unit 42 identified a new Gremlin stealer variant that hides its payload in the .NET Resource section under single-byte XOR encoding and exfiltrates stolen data to a newly deployed site at hxxp[:]194.87.92[.]109, which showed zero VirusTotal detections at discovery. The malware now uses a commercial packer with instruction virtualization, decrypts critical functions into memory only when needed, and adds modules for Chromium session-token theft, Discord token stealing, and clipboard hijacking that swaps cryptocurrency wallet addresses.

Bottom line: At discovery, the exfiltration site, its URLs and retrieved artifacts had no block list entries, community reports or malicious categorizations, so signature-based defenses had nothing to match on. The clipboard hijacker also turns each infection into ongoing financial fraud, not a one-time credential loss.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026