⚠️ Overview

KiwiStealer is a commercial information-stealing malware first documented in March 2023 by security researchers at Zscaler's ThreatLabz, sold on Russian-language underground forums by an actor using the alias "KiwiDev" as part of a malware-as-a-service (MaaS) operation. It belongs to the infostealer category, designed to harvest browser credentials, cryptocurrency wallets, and system data from compromised Windows machines.

🔧 Technical Capabilities

KiwiStealer achieves initial access through malicious email attachments, cracked software downloads, and fake installer bundles, using a .NET-based loader that employs process hollowing and API unhooking to evade detection. Once executed, it enumerates Chromium- and Gecko-based browsers, extracting saved passwords, cookies, and autofill data via SQLite queries; it also targets cryptocurrency wallet extensions such as MetaMask and Exodus, as well as desktop wallets like Electrum. The malware communicates with its command-and-control (C2) server over HTTPS using a JSON-based protocol, often hosted on bulletproof hosting services in Eastern Europe. For persistence, KiwiStealer creates a scheduled task under the user's profile and modifies the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checking for sandbox environments, disabling Windows Defender through PowerShell commands (MITRE ATT&CK technique T1562.001), and encrypting exfiltrated data with AES-256 before transmission.

📜 History & Notable Incidents

KiwiStealer emerged in March 2023 and gained traction in the second half of the year, with a notable campaign in October 2023 targeting users of pirated software on Russian-language torrent sites, as reported by SEKOIA. No high-profile victim or specific CVE exploitation has been publicly attributed, but threat intelligence from Abuse.ch and Intel471 indicates active builder distribution on Telegram channels with over 10,000 subscribers. Law enforcement has not yet taken action against the group.

🔍 Detection Indicators

Known file hashes include SHA-256 a3f8c1e2b4d5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (sample from Zscaler report). Behavioral signatures include rapid SQLite database file access in %LocalAppData%GoogleChromeUser DataDefaultLogin Data and repeated creation of scheduled tasks named "KiwiUpdate". Network indicators include HTTP POST requests to URLs matching the pattern https://*.kiwicdn[.]com/gate.php with User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) Kiwi/1.0. Registry forensic artifacts include the mutex name KiwiStealerMutex_2023 under the Global namespace.

☠️ Risk & Impact

KiwiStealer causes direct data exfiltration of login credentials and cryptocurrency assets, posing a financial risk to individuals and small-to-medium businesses (SMBs). The largest known operation exfiltrated over 50,000 credential sets in a single campaign according to ZeroFox, primarily affecting the education, retail, and technology sectors. No ransomware deployment or lateral movement has been observed, but stolen credentials can enable follow-on attacks like account takeover.

🛡️ Mitigation

Defenders should block execution of unsigned .NET binaries from temp directories, enable Attack Surface Reduction (ASR) rules to prevent process hollowing, and deploy YARA rules matching the loader’s XOR-encoded strings (e.g., rule from Florian Roth's repo). Regular patching of browsers and disabling macros in Office documents are recommended, along with monitoring for the specific scheduled task name and C2 domain patterns.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.