Luca Stealer
Stealer⚠️ Overview
Luca Stealer is a Rust-based information stealer first documented in February 2022 by cybersecurity firm Cyble. It is attributed to an unknown threat actor operating as “Luca” on underground forums and belongs to the stealer category, targeting credentials, cryptocurrency wallets, and browser data for exfiltration.
🔧 Technical Capabilities
Luca Stealer collects saved passwords, cookies, autofill data, and credit card details from Chromium- and Firefox-based browsers by reading local SQLite databases. It targets over 20 cryptocurrency wallet extensions, including MetaMask, Exodus, and Binance Chain Wallet, by scanning browser extension directories. The malware uses Telegram Bot API as its command-and-control (C2) infrastructure: exfiltrated data is archived into a ZIP file and uploaded to Telegram via a bot token hardcoded in the binary. It achieves persistence by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include checking for virtual machine environments (VMware, VirtualBox) and terminating execution if detected; it also uses process hollowing to inject malicious code into legitimate processes. Luca Stealer is written in Rust, which hinders static analysis due to the language’s unique binary structure.
📜 History & Notable Incidents
Luca Stealer was first advertised on a Russian-language dark web forum in early 2022 for a subscription price of $20–$30 per month. In March 2022, Cyble published a technical analysis (report ID CYBLE-2022-0301) detailing its Telegram C2 mechanics. No high-profile corporate victims have been publicly disclosed; the malware is primarily used against individual users and small businesses via spear-phishing emails and cracked software downloads. No CVEs are directly associated with Luca Stealer as it relies on social engineering rather than exploiting unpatched vulnerabilities.
🔍 Detection Indicators
Indicators of compromise (IOCs) include the Telegram Bot API token pattern https://api.telegram.org/bot
☠️ Risk & Impact
The primary risk is credential and cryptocurrency theft, potentially leading to account takeovers and financial losses. The malware can exfiltrate two-factor authentication tokens stored in browser sessions, bypassing some 2FA protections. Affected sectors include individual cryptocurrency users and small-to-medium enterprises, with no major industry-wide impact reported as of mid-2025.
🛡️ Mitigation
Defenses include blocking Telegram API domains at the network perimeter, enabling browser extension policies to restrict wallet add-ons, and using endpoint detection rules for process hollowing and registry run-key modifications. Organizations should deploy YARA rules targeting Rust-based binaries with Telegram Bot API string patterns, as recommended by Cyble’s advisory. Regular user awareness training against phishing with lures such as fake software cracks or invoice PDFs is essential.
Similar Threats
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
