SalatStealer Malware: Inside a Credential Stealer Built for Repeat Use

Introduction to SalatStealer Malware

SalatStealer is a Go-based infostealer family first observed in August 2026, built for x86 Windows environments and focused on credential theft. Its documented capabilities include stealing authentication credentials, hiding executing code, and degrading security software. In the observed context, it appeared as a separate Windows stealer staged alongside a large-scale Dahua camera compromise operation, indicating value as an additional credential-harvesting capability rather than part of the camera intrusion chain.

Delivery Methods of SalatStealer Malware

SalatStealer was observed as a UPX-packed Windows binary staged on an operator host and renamed from xeno.exe to 1.exe before use. The same binary was identified on a second host two days later under its original filename, indicating repeat staging across separate operator touchpoints. Distribution through pirated software is also documented for SalatStealer in other unrelated operations.

TTPs and Technical Behavior of SalatStealer Malware

After execution, SalatStealer’s core behavior centers on authentication-credential theft, aligning with its role as an infostealer. It also uses code-hiding measures consistent with packing or other concealment techniques, and its observed Windows-side support tooling included a five-method PowerShell framework to broadly weaken Microsoft Defender protections. The binary was specifically associated with defense evasion, credential access, and collection activity.

Impact of SalatStealer Malware

A successful SalatStealer infection can expose authentication material that enables unauthorized account access and follow-on intrusion activity. Its use alongside a Defender-bypass framework increases the chance of stealthy collection on Windows systems and reduces the likelihood of early detection. Because it was staged as a distinct capability in parallel with another operation, affected organizations should treat its presence as a separate credential-compromise incident.

Threat Actors, Campaigns, and Market Presence of SalatStealer Malware

SalatStealer is described as a commodity credential and cryptocurrency stealer sold as a service. It has been resold across at least five unrelated campaigns, including phishing against Ukrainian government targets, a loader operation, a fake-videocall credential-theft crew, an AI-generated cryptominer campaign, and distribution tied to pirated software. That spread indicates broad operator access rather than an exclusive link to a single threat actor.

About Check Point Exposure Management

Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.

SalatStealer Malware TTPs

SalatStealer Malware IOCs (Sample of 50)