Storm Infostealer - New Malware Remotely Decrypts Credentials
Basically, Storm is a new type of malware that steals and decrypts your passwords remotely.
A new infostealer named Storm has emerged, capable of remotely decrypting stolen credentials. This poses a serious risk to users, as it targets sensitive data from browsers and crypto wallets. With its stealthy approach, Storm can bypass many security measures, making it crucial for users to stay vigilant.
What Happened
Security researchers at Varonis have discovered a new infostealer malware strain called Storm. This malware is designed to harvest sensitive information such as browser credentials, session cookies, and crypto wallet data. Unlike traditional infostealers, Storm employs a novel approach by decrypting stolen credentials on its own servers rather than on the victim's machine.
How It Works
Storm operates by sending encrypted files to the attacker's server for decryption. This method helps it bypass security controls that would typically flag local decryption attempts. Daniel Kelley, a senior security consultant at Varonis, explained that previous infostealers decrypted credentials directly on the victim's device, which became easier to detect as security tools evolved. With Storm, the malware collects data and transfers it to the attacker, where it can be decrypted without leaving traces on the victim's machine.
Who's Being Targeted
The malware primarily targets users of Chromium and Gecko-based browsers, including popular options like Firefox. It can extract a wide range of sensitive information, including:
- Saved passwords
- Session cookies
- Autofill data
- Google account tokens
- Credit card information
- Browsing history
Signs of Infection
Victims may not notice anything unusual at first. However, compromised browsers can provide attackers with authenticated access to various platforms, including SaaS applications and internal tools, without triggering alerts. The stealthy nature of Storm makes it particularly dangerous, as it operates in memory to minimize detection risks.
How to Protect Yourself
To defend against threats like Storm, users should:
- Regularly update their browsers and security software.
- Use strong, unique passwords for different accounts.
- Enable two-factor authentication wherever possible.
- Monitor accounts for suspicious activities.
What Data Was Exposed
During the investigation, Varonis identified 1,715 entries linked to Storm, originating from multiple countries, including Brazil, India, and the US. The stolen credentials cover high-value platforms such as:
- Social media: Google, Facebook, Twitter/X
- Cryptocurrency services: Coinbase, Binance, Crypto.com
This type of data is often traded on underground markets, leading to account takeovers and further cyber intrusions.
Conclusion
Storm represents a significant evolution in infostealer technology. By remotely decrypting stolen credentials, it poses a heightened risk to users and organizations alike. Awareness and proactive security measures are essential to mitigate the threats posed by such advanced malware.