TROX STEALER: A DEEP DIVE INTO A NEW MALWARE AS A SERVICE (MAAS) ATTACK CAMPAIGN

Summary from the TLDR InfoSec newsletter

TROX Stealer, a Malware-as-a-Service first identified in December 2024, uses urgent debt collection phishing emails to entice victims into downloading malicious executables. It features a multi-stage execution chain with Python, Node.js, and WebAssembly to evade detection, stealing sensitive data like credit cards, browser credentials, cryptocurrency wallets, and Discord/Telegram session files. The attackers have a structured infrastructure, with domains registered nine months prior to the attack, indicating careful planning and marketing on hacking forums.