SANTASTEALER IS COMING TO TOWN: A NEW, AMBITIOUS INFOSTEALER ADVERTISED ON UNDERGROUND FORUMS

Summary from the TLDR InfoSec newsletter

SantaStealer is a new malware-as-a-service info‑stealer advertised in Telegram channels and forums that can exfiltrate documents, credentials, crypto wallets, and other sensitive data from numerous applications. It uses a modular, multi-threaded design that runs mostly in memory. The software gathers data from browsers, messaging apps, and gaming platforms, zips everything, splits it into 10 MB chunks, and sends it over unencrypted HTTP to attacker-controlled servers.