SolyxImmortal Python Malware Steals Browser Data and Keystrokes

Key Takeaways

• SolyxImmortal is a newly identified Python-based information stealer targeting Windows systems.
• The malware is designed to exfiltrate sensitive data, including browser passwords, cookies, keystrokes, and specific document types.
• It employs stealth techniques and persistence mechanisms, masquerading as a Windows graphics driver.
• SolyxImmortal notably targets Turkish-speaking users, indicated by Turkish keywords within its code and file names.
• Data exfiltration occurs via Discord webhooks, a common tactic for evading traditional network defenses.

Cybersecurity researchers have uncovered SolyxImmortal, a new Python-based malware actively compromising Windows environments. This sophisticated threat is engineered to surreptitiously harvest browser credentials, cookies, sensitive documents, and user keystrokes. A comprehensive examination of SolyxImmortal’s operational capabilities, including its covert data exfiltration methods, is detailed in a recent report.

The malware leverages established Python libraries and multi-threading to execute its malicious functions concurrently, enhancing its ability to operate undetected in the background.

Targeting Turkish-Speaking Users

A distinctive feature of SolyxImmortal is its apparent focus on Turkish-speaking individuals. The malware’s codebase incorporates several Turkish keywords, specifically related to banking websites, Gmail logins, and general sign-in portals.

These embedded keywords trigger targeted screenshot captures when an active window’s title matches any of them, suggesting a deliberate targeting of a specific linguistic demographic. Researchers at Pulsedive, in a report shared with Cyber Security News (CSN), confirmed the malware’s use of Discord webhooks as its primary data exfiltration channel.

Upon collecting compromised information, SolyxImmortal bundles and transmits the data directly to a Discord channel controlled by the attacker, flagging a predefined user ID upon successful delivery.

The malware first appeared in public threat intelligence databases, with a sample available on Malware Bazaar. While the analyzed sample lacked active webhook URLs, prior public reports from Cyfirma indicated that live versions of the malware utilized legitimate Discord endpoints.

Despite its compact size—a Python script weighing just over 10,000 bytes—SolyxImmortal poses a significant threat to infected systems.

Once established on a system, SolyxImmortal quickly ensures its continued presence. It replicates itself into the APPDATA directory, masquerades as a Windows graphics driver file, and creates a registry key to launch automatically each time the user logs in. This mechanism guarantees the malware’s persistence across system reboots without requiring further attacker intervention.

SolyxImmortal Python Malware Capabilities

From the moment of execution, SolyxImmortal initiates a broad data collection effort. It extracts saved passwords from Chromium-based browsers, including Chrome, Edge, Brave, and OperaGX, by accessing their local databases and decrypting stored credentials using AES encryption.

All stolen credentials are saved in a file named “sifreler.txt,” which translates to “passwords” in Turkish. Beyond passwords, the malware also captures Firefox cookies by copying the browser’s cookie database to a temporary staging folder.

It then scans the user’s home directory for documents in .txt, .pdf, .docx, and .xlsx formats. Files ranging from 100 bytes to 10 MB are copied and compressed into a zip archive titled “Solyx_Final_Data.zip” before being uploaded to Discord.

A separate thread operates the keylogger, meticulously recording every keystroke made by the user. Every 60 seconds, these collected keystrokes are packaged as a JSON blob and transmitted to the attacker. The screen capture functionality operates in two distinct modes: routine screenshots taken every two minutes, and immediate screenshots triggered when a sensitive keyword appears in the active window’s title bar.

How SolyxImmortal Stays Hidden and Sends Data Out

SolyxImmortal employs several tactics to evade detection. It saves itself as “win_gfx_driver.exe” and modifies its file attributes to hidden and system, rendering it invisible during standard file browsing. The persistence registry key it establishes, named “WindowsGfxDriver,” mimics a legitimate Windows component, potentially allowing it to be overlooked during routine system inspections.

Data exfiltration from the compromised machine occurs via Discord’s web API, utilizing Python’s ‘requests’ library. This method allows malicious traffic to blend seamlessly with legitimate web activity. The growing trend of malware using popular platforms like Discord for command and control is due to their seldom-blocked status by firewalls and their resemblance to normal user traffic.

What You Should Do

• Implement Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor for unusual process behavior that may indicate a SolyxImmortal infection or similar threats.
• Restrict Python Execution: Limit Python execution privileges to only those users and systems that genuinely require it, thereby reducing the potential attack surface.
• Enhance User Awareness Training: Conduct regular training for users to recognize and report phishing emails, suspicious attachments, and other social engineering tactics, as these are common initial vectors for such malware.
• Regularly Back Up Data: Maintain regular backups of critical data to mitigate the impact of data theft or system compromise.
• Monitor Network Traffic: Implement network monitoring to detect unusual outbound connections, especially to services like Discord webhooks, which could indicate data exfiltration.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.