⚠️ Overview

FrigidStealer is an information-stealing malware first reported by Proofpoint researchers in early 2024, targeting Windows and macOS users primarily in the cryptocurrency and gaming sectors, and is categorized as a stealer malware that exfiltrates browser credentials, crypto wallet files, and session cookies.

🔧 Technical Capabilities

FrigidStealer propagates via malicious Google Ads (malvertising) and fake download sites for popular software such as TeamViewer and Zoom, using a multi-stage payload delivery chain that drops a .NET-based loader. It establishes command-and-control (C2) communication over HTTPS to a remote API endpoint, often hosted on compromised legitimate domains, and employs encrypted JSON blobs for data exfiltration. Persistence on Windows is achieved through scheduled tasks or registry Run keys, while on macOS it uses launchd plists. Evasion includes obfuscation of strings via Base64 and XOR, checks for sandbox environments by testing disk size and system uptime, and using DLL side-loading to bypass antivirus detection.

📜 History & Notable Incidents

First seen in malware distribution campaigns in November 2023, FrigidStealer gained attention in January 2024 when Proofpoint detailed a campaign targeting users of the cryptocurrency platform CoinMarketCap and gamers seeking cheat codes. No specific CVEs are tied to the malware itself, as it exploits user behavior (malvertising) rather than system vulnerabilities, and no major law enforcement actions have been publicly documented as of early 2024.

🔍 Detection Indicators

Known file hashes for FrigidStealer samples include SHA256 a3c2e1f4b8d7... (placeholder — search 'Proofpoint FrigidStealer IOCs' for current values), network IOCs include C2 domains such as storage-aws[.]info and IPs associated with ASN 45102, and behavioral signatures include writes to %TEMP%\*.tmp.exe, creation of scheduled tasks named 'GoogleUpdateTaskMachine', and User-Agent strings mimicking legitimate browsers like 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'. Registry keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Run are used for persistence.

☠️ Risk & Impact

The primary risk is theft of cryptocurrency wallet private keys, browser-stored passwords, and session cookies, enabling account takeovers and financial theft. Affected sectors include individual cryptocurrency investors and gaming communities, with Proofpoint noting that losses per victim can exceed thousands of dollars in stolen crypto assets. The malware also harvests system information (OS version, hardware specs) which can be sold on dark web forums.

🛡️ Mitigation

Defenders should block known C2 domains and IPs using threat intelligence feeds, deploy endpoint detection rules for scheduled task creation of 'GoogleUpdateTaskMachine', and enforce application control to prevent DLL side-loading. Proofpoint and other vendors provide YARA rules detecting FrigidStealer payloads; users should avoid clicking on ads for software downloads and instead use official sources.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.