New Raven Stealer Malware Hits Browsers for Passwords and Payment Data

A new sneaky type of malware, known as Raven Stealer, has been identified by the Lat61 Threat Intelligence Team at Point Wild. The research team, led by Onkar R. Sonawane, have found that this simple-looking program is surprisingly good at staying hidden while it steals your personal information. The research, which was shared with Hackread.com, shows that the malware is primarily spread through underground forums and bundled with pirated software.

Built using the programming languages Delphi and C++, Raven Stealer is designed to be small and quick. It works by quietly getting into your computer, where its payload (the part of the malware that does the actual harm) goes to work.

The payload targets popular web browsers like Chrome and Edge to grab things like your passwords, cookies, payment details, and other information you’ve saved. What makes it particularly tricky is that it can send this stolen information directly to a cybercriminal using a Telegram messaging bot. This means the bad guys get your data in real-time.

Point Wild’s report explains that Raven Stealer uses a clever trick called process hollowing to avoid being caught by traditional antivirus programs. This means, instead of leaving a file on your computer’s hard drive, it works entirely within your computer’s memory, pretending to be a regular browser program. It’s like a car thief hollowing out a car and putting a different engine in it, so it looks normal from the outside but is used for something else entirely. This technique makes it tough for security software to spot it.

The malware’s creator used a simple builder program to create the attack file, which hides an encrypted “payload” inside and gives it a unique name to avoid detection. Once on an infected computer, it gathers a screenshot and stolen data into a ZIP file, then tries to send it to the attacker via Telegram. Although this transmission failed in testing due to a Telegram bot token problem, the threat of data theft remains.

To keep your personal information safe from threats like this, always use up-to-date antivirus software with real-time protection and avoid downloading pirated programs. It’s also wise to be careful about clicking on suspicious links or attachments.

As Dr. Zulfikar Ramzan, CTO of Point Wild and Head of the Lat61 Threat Intelligence Team, explains, “Raven Stealer shows how commodity malware is evolving – stealing credentials, cookies, and payment data while hiding its tracks through in-memory execution and Telegram exfiltration. It’s a reminder that attackers are packaging advanced techniques into tools that even low-skilled actors can use.”