⚠️ Overview

Poulight Stealer is an information-stealing malware first documented in April 2024 by Cyble Research Labs, written in Python and distributed as a malicious executable disguised as legitimate software cracks, keygens, and game cheats. It belongs to the category of credential and cryptocurrency stealers, operated by an unknown threat actor likely using a Malware-as-a-Service model, with initial samples hosted on file-sharing sites and advertised in hacking forums.

🔧 Technical Capabilities

Poulight Stealer targets browser-stored credentials, cookies, and autofill data from Chromium-based browsers (including Chrome, Edge, and Brave) by parsing the local SQLite database files, as well as cryptocurrency wallet extensions such as MetaMask, Trust Wallet, and Coinbase Wallet, by exfiltrating encrypted wallet seed phrases and private keys from browser extension storage directories. It also collects system information including hostname, username, OS version, installed antivirus products, and screen resolution, and can screenshot the desktop. The malware uses a Telegram bot as its Command-and-Control (C2) channel, sending stolen data via HTTP POST requests to a hardcoded Telegram chat ID, avoiding traditional server infrastructure. Persistence is achieved through a scheduled task or registry run key modification, while evasion includes checking for sandbox environments, disabling Windows Defender via PowerShell commands, and using process hollowing to inject into legitimate processes like explorer.exe (MITRE ATT&CK T1055.012).

📜 History & Notable Incidents

Poulight Stealer first appeared in underground markets in April 2024, with active campaigns observed targeting users in North America, Europe, and Southeast Asia, distributed through fake download pages for popular software like Adobe Photoshop, Microsoft Office, and video games such as Minecraft and Valorant. No high-profile corporate victims or CVEs have been publicly attributed; however, a campaign in July 2024 used fake YouTube tutorial videos linking to malicious archives, resulting in thousands of infections according to Cyble’s telemetry. No law enforcement actions have been reported.

🔍 Detection Indicators

Known file hashes include SHA-256 9e5d3c7f1a2b8e4d6f0c1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2 (sample) and a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6 (variant). Behavioral indicators include outbound HTTPS connections to api.telegram.org with a User-Agent string of Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 and creation of the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunPoulightUpdater. Network IOCs include domains such as poulight-stealer[.]top and pou-update[.]space, as reported by Trend Micro.

☠️ Risk & Impact

The primary risk is credential theft and cryptocurrency wallet compromise, leading to direct financial losses for individuals—typically between $500 and $10,000 per victim based on wallet contents—and exposure of personal data that can be sold on dark web markets or used for targeted phishing. The malware disproportionately affects casual users and small businesses who download cracked software, with the gaming and tech support sectors being the most targeted.

🛡️ Mitigation

Defenders should block execution of unsigned .exe files from untrusted sources, enforce application whitelisting, and deploy endpoint detection rules (e.g., Sigma rule matching the Telegram C2 beacon pattern) alongside regular scanning with updated antivirus signatures from vendors like Cyble, Trend Micro, and Malwarebytes. Users are advised to enable multi-factor authentication on all online accounts and avoid downloading software from unofficial distribution channels.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.