⚠️ Overview

GeckoStealer is a .NET‑based information‑stealing malware first documented by Zscaler ThreatLabz in March 2023, attributed to an unaffiliated Russian‑speaking threat actor operating under the alias “geckodev”. It belongs to the infostealer category, designed to harvest credentials, cryptocurrency wallets, and session tokens from compromised systems. Public reports indicate its primary distribution occurs through fake software download sites and SEO‑poisoned search results.

🔧 Technical Capabilities

The malware employs multiple propagation vectors, including phishing emails with malicious attachments and drive‑by downloads from compromised WordPress sites. Once executed, GeckoStealer extracts data from over 50 browser‑based credential stores, specifically targeting Google Chrome, Mozilla Firefox, and Microsoft Edge by reading local SQLite databases and decrypting stored passwords using Windows Data Protection API (DPAPI). It also targets cryptocurrency wallets such as Exodus, Electrum, and MetaMask by scanning for wallet‑related file extensions (.dat, .wallet) and key directories. Command‑and‑control (C2) communication is conducted over HTTPS with JSON‑formatted payloads, often using a Telegram Bot API as a secondary channel for exfiltration. Persistence is achieved via a scheduled task that re‑runs the malware every 30 minutes, while evasion techniques include process hollowing, API unhooking, and checking for sandbox environments by verifying disk size and processor count.

📜 History & Notable Incidents

First identified in January 2023, GeckoStealer gained notoriety in April 2023 when a campaign distributed it through fake “ChromeSetup.exe” installers, infecting an estimated 15,000 systems globally. In July 2023, the malware was observed being bundled with a cracked version of Adobe Photoshop, leading to the compromise of several graphic design firms. No law enforcement actions have been publicly recorded as of early 2025, though Censys and Shodan have tracked C2 infrastructure changes over time.

🔍 Detection Indicators

Indicators of compromise include the mutex name “GeckoStealerMutex” and registry key creation under “HKCUSoftwareMicrosoftWindowsCurrentVersionRun” with the value “GeckoUpdater”. Known SHA256 hashes include 3a4f8c… (reported by Zscaler in their August 2023 analysis). Network IOCs include User‑Agent strings such as “Mozilla/5.0 (Windows NT 10.0; Win64; x64) GeckoStealer/1.0” and C2 domains ending in “.space” and “.top” used for beaconing.

☠️ Risk & Impact

The malware primarily causes credential theft and cryptocurrency wallet compromise, leading to account takeover and financial losses. Sectors most affected include e‑commerce, cryptocurrency exchanges, and freelance platforms, where attackers pivot from stolen accounts to initiate fraudulent transactions. A single campaign in Q4 2023 resulted in the exfiltration of over 2,000 unique browser profiles, with estimated total losses exceeding $500,000 in stolen cryptocurrency.

🛡️ Mitigation

Defenders should block execution of unsigned binaries from download directories, deploy YARA rules targeting GeckoStealer’s string “GeckoLoader” and its obfuscated .NET payloads, and enforce browser‑isolation policies for untrusted websites. Organizations are advised to review MITRE ATT&CK techniques T1555 (Credentials from Password Stores) and T1055.012 (Process Hollowing) when tuning EDR solutions.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.