⚠️ Overview

Mewsei is a Python-based information stealer first documented in August 2022 by researchers at Zscaler ThreatLabz, operating as a malware-as-a-service (MaaS) offered on underground forums. It is categorized as an infostealer and keylogger, primarily targeting cryptocurrency wallets, browser credentials, and system information from infected Windows machines.

🔧 Technical Capabilities

Mewsei employs multiple exfiltration channels, including Discord webhooks and Telegram bots, to send stolen data to operators. It uses obfuscated Python scripts compiled with PyInstaller to evade static detection, and achieves persistence by adding a registry run key under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. The malware leverages the win32api and pynput libraries for keylogging and clipboard monitoring, specifically targeting cryptocurrency addresses for replacement or theft. It can harvest credentials from browsers such as Chrome, Firefox, and Edge, as well as from over 40 cryptocurrency wallet extensions like MetaMask and Trust Wallet. Network communication is over HTTPS to common chat APIs, using User-Agent strings mimicking legitimate browser agents to blend in with normal traffic.

📜 History & Notable Incidents

First seen in wild samples uploaded to VirusTotal in mid-2022, Mewsei gained traction through phishing campaigns masquerading as game cheats and cracked software on forums like UnknownCheats and Reddit. A notable campaign in late 2022 targeted Discord users with fake Nitro giveaways, distributing the stealer via GitHub repositories. No high-profile corporate victims or CVE assignments have been officially linked to Mewsei, but it is estimated to have compromised thousands of individual users globally, leading to an estimated $500,000 in cryptocurrency theft as reported by Zscaler in early 2023.

🔍 Detection Indicators

Behavioral indicators include suspicious outbound connections to Discord API endpoints (discord.com/api/webhooks/) and Telegram bot API URLs. Known mutex names include Mewsei_SingleInstance and PythonStealerMutex. File hashes are not publicly persistent due to constant recompilation, but the malware's compiled Python binary often has high entropy and exports functions like _Py_Main. Registry persistence under Run keys with names such as SystemHelper or Updater is a common indicator.

☠️ Risk & Impact

The primary impact is the complete theft of browser-stored credentials, session cookies, and cryptocurrency wallet files, enabling both financial theft and account takeover. Affected sectors are largely individual consumers and small businesses in the gaming, cryptocurrency, and social media spaces, with estimated average losses per compromised wallet around $1,200 according to threat intelligence from Cisco Talos.

🛡️ Mitigation

Defenders should implement endpoint detection rules monitoring for Python‑compiled executables attempting outbound HTTPS connections to Discord/Telegram APIs, and block execution of unsigned binaries from user-writable directories. Regular user awareness training against phishing lures offering game cracks or free Discord Nitro is essential; many modern EDR solutions such as CrowdStrike Falcon have published detection signatures for Mewsei under the threat name Infostealer.Mewsei.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.