In early December 2025, a highly targeted malware campaign was identified that focused on compromising software developers through malicious extensions distributed via trusted development tooling ecosystems. The operation, tracked internally as Evelyn Stealer, represents a mature, multi-stage credential theft campaign designed to exploit developer trust, evade modern detection mechanisms, and extract high-value data including credentials, cryptocurrency assets, and system intelligence.
Unlike opportunistic malware, this campaign demonstrates deliberate targeting, operational discipline, and a deep understanding of Windows internals, browser security architecture, and developer workflows. The attackers treated the developer environment itself as the delivery mechanism, turning trusted extensions into the initial infection vector.
Target Profile and Impacted Sectors
Primary Targets
- Individual software developers
- Open-source contributors
- Freelance developers
- Blockchain and Web3 developers
- DevOps engineers
- Developers with access to CI/CD pipelines and cloud infrastructure
Impacted Industries
- Software development
- Blockchain and cryptocurrency
- FinTech
- SaaS providers
- Cloud service operators
- Game development studios
- AI and machine learning startups
Organizational Risk
A single compromised developer workstation can lead to:
- Theft of source code and intellectual property
- Compromise of private repositories
- Abuse of cloud credentials and API tokens
- Supply-chain attacks via poisoned commits or packages
- Direct cryptocurrency theft
Attack Chain Overview
The Evelyn Stealer campaign uses a three-stage architecture:
- Initial access via malicious code editor extension
- Downloader masquerading as a legitimate DLL
- Process hollowing injector
- Final info-stealer payload
Each stage is purpose-built and minimizes exposure, ensuring stealth and persistence.
Stage 1: Initial Access and Downloader Execution
Delivery Vector
The infection begins when a developer installs a weaponized extension disguised as a legitimate productivity or development aid. Once installed, the extension drops a malicious DLL into the environment.
Masquerading Technique
The DLL is named and structured to impersonate a legitimate Lightshot dependency. This allows it to be side-loaded when the legitimate executable launches.
File Details
| File Name | SHA-256 | Type |
|---|---|---|
| Lightshot.dll | 369479bd9a248c9448705c222d81ff1a0143343a138fc38fc0ea00f54fcc1598 | DLL |
Execution Mechanics
- Loaded automatically due to Windows DLL search order
- Exposes legitimate-looking exported functions to avoid suspicion
- Executes payload immediately upon load
- Uses a singleton execution pattern
- Creates a mutex to prevent multiple instances
Persistence and Control
- Mutex ensures one active instance per system
- Execution occurs within the trusted process context
Payload Delivery
The DLL launches a hidden PowerShell process that:
- Downloads the second-stage payload
- Writes it to
%LOCALAPPDATA%\Temp - Renames it as
runtime.exe - Executes it silently
Stage 2: Injector and Process Hollowing
File Details
| File Name | SHA-256 | Type |
|---|---|---|
| iknowyou.model | 92af258d13494f208ccf76f53a36f288060543f02ed438531e0675b85da00430 | EXE |
Purpose
This stage acts as a process hollowing injector, responsible for decrypting and injecting the final payload into a legitimate Windows process.
Target Process
grpconv.exe(a trusted Windows utility)
Execution Flow
- Dynamically resolves Windows APIs
- Creates
grpconv.exein suspended mode - Decrypts embedded payload using AES-256-CBC
- Injects decrypted payload into suspended process
- Resumes execution
Cryptographic Details
- AES Key (32 bytes)
2e649f6145f55988b920ff5a445e63aae29c80495b830e0d8bb4b3fff4b1f6f4 - IV (16 bytes)
5c507b22e9814428c5f2b1ef213c5c4a
This ensures that the final payload is never stored unencrypted on disk.
Stage 3: Final Payload – Evelyn Stealer
File Details
| File Name | SHA-256 | Type |
|---|---|---|
| EvelynStealer.exe | aba7133f975a0788dd2728b4bbb1d7d948e50571a033a1e8f47a2691e98600c5 | EXE |
Anti-Analysis and Evasion Techniques
Before activating malicious functionality, Evelyn Stealer performs extensive environment checks:
Virtual Machine Detection
- GPU fingerprinting (VMware, VirtualBox, Hyper-V, QEMU, VirtIO)
- Disk size checks (< 60 GB flagged)
- Hostname analysis
- VM-related process enumeration
- Registry inspection for virtual hardware identifiers
Sandbox and Research Detection
- Debugger detection
- RDP session checks
- Hyper-V artifacts
- Timing anomalies
If analysis conditions are detected, execution is halted.
Data Collection and Theft Capabilities
Workspace Setup
- Creates a dedicated directory under
%APPDATA% - Organizes stolen data by category
Browser Credential Theft
- Terminates active browser processes
- Recovers existing browser data
- Uses DLL injection to access decrypted credentials in memory
Browser Injection Component
abe_decrypt.dll
Acquisition Priority
- TEMP directory
- FTP server download
- Local directory fallback
DLL Hash
74e43a0175179a0a04361faaaaf05eb1e6b84adca69e4f446ef82c0a5d1923d5
Browser Launch Flags
The malware launches browsers with stealth-oriented flags:
--headless=new--disable-gpu--no-sandbox--disable-extensions--disable-logging--silent-launch--no-first-run--disable-popup-blocking--window-position=-10000,-10000--window-size=1,1
This allows credential extraction without user awareness.
Additional Data Harvested
- System details (OS, hardware, installed software)
- Running processes
- VPN configurations
- Clipboard contents
- Wi-Fi credentials
- Sensitive files
- Cryptocurrency wallets (MetaMask, Phantom, Trust Wallet, others)
- Desktop screenshots
Data Packaging and Exfiltration
Archive Naming Convention
The stolen data is compressed into a ZIP file using a detailed identifier format:
COUNTRY-IP-USERNAME-OS-CRYPTO-PAYPAL-CRYPTO_SITES-RAM-GPU-METAMASK-PHANTOM-TRUSTWALLET-OTHER-TIMESTAMP.zip
Exfiltration Channel
- FTP protocol
- Custom authentication
- Obfuscated transfer intervals
Command-and-Control Infrastructure
Known Network Indicators
| Indicator | Type |
|---|---|
| server09.mentality[.]cloud | FTP Server |
| syn1112223334445556667778889990[.]org | HTTP Server |
Indicators of Compromise (IoCs)
File Hashes
| File | SHA-256 |
|---|---|
| Lightshot.dll | 369479bd9a248c9448705c222d81ff1a0143343a138fc38fc0ea00f54fcc1598 |
| iknowyou.model | 92af258d13494f208ccf76f53a36f288060543f02ed438531e0675b85da00430 |
| EvelynStealer.exe | aba7133f975a0788dd2728b4bbb1d7d948e50571a033a1e8f47a2691e98600c5 |
| abe_decrypt.dll | 74e43a0175179a0a04361faaaaf05eb1e6b84adca69e4f446ef82c0a5d1923d5 |
Strategic Assessment
This campaign reflects a shift toward developer-centric threat models. Instead of mass infection, the attackers pursued quality over quantity, targeting individuals whose access could yield disproportionate impact.
The use of trusted tooling, staged loaders, encrypted payloads, memory-only credential access, and disciplined operational security indicates a threat actor with strong technical expertise and long-term objectives.
Defensive Considerations
Organizations should:
- Enforce strict extension allow-listing
- Monitor DLL side-loading behavior
- Restrict PowerShell abuse
- Protect developer endpoints as high-value assets
- Monitor FTP traffic from user workstations
- Assume developer compromise as a supply-chain risk
Closing Thoughts
Evelyn Stealer is not just another info-stealer. It represents an evolution in attacker thinking, where developers are no longer collateral damage but primary entry points. As development environments grow more powerful and interconnected, attackers will continue to weaponize trust itself.
Defending against this class of threat requires rethinking how developer systems are secured, monitored, and treated within enterprise risk models.
