Lucid Stealer Targets 18 Browsers, Crypto Wallets, Discord Tokens

Key Takeaways

• Lucid Stealer is a sophisticated Windows malware strain offering extensive data theft and remote access capabilities.
• The threat targets 18 browsers, numerous crypto wallets, and Discord tokens, operating as a commercial, subscription-based service.
• Its evasion techniques include disguising itself within a legitimate Node.js runtime and plans to shift to Java.
• Infections should be considered full system compromises, requiring immediate and comprehensive remediation.

A new Windows malware variant, dubbed Lucid Stealer, has emerged as a significant concern for cybersecurity experts, exhibiting an alarming breadth of capabilities and sophisticated evasion tactics. This threat, initially identified through clandestine Telegram channels, extends far beyond typical credential theft, enabling complete control over infected systems without user awareness.

What makes Lucid Stealer particularly insidious is its method of concealment. The entire malicious package is cleverly embedded within a legitimate Node.js runtime environment, allowing it to masquerade as a benign application, thereby bypassing many conventional security defenses while silently executing its harmful operations.

Researchers at Foresiet first detected and analyzed this iteration of Lucid Stealer. Their investigation was prompted by renewed activity on a dedicated Telegram channel promoting the tool as a paid, subscription-based product. Foresiet’s report, shared with Cyber Security News (CSN), highlights that this specific build is significantly more potent than standard credential stealers, integrating both extensive data exfiltration and live remote access functionalities.

The malware is marketed as a commercial service, featuring a dedicated web panel for management, license key distribution, and an active support channel. Operators briefly paused the project in late May 2026, only to relaunch it days later with announcements of a complete site rebuild and a strategic shift from Node.js to Java, aimed at enhancing evasion capabilities. This continuous development underscores the attackers’ commitment to evolving and expanding the threat.

Given its capabilities, any infection by Lucid Stealer must be treated as a full system compromise. User credentials, browser cookies, Discord session data, crypto wallet keys, and Roblox session information are all immediately vulnerable. Defenders are strongly advised to assume that all data stored on an infected machine has been compromised and to act swiftly.

New Lucid Stealer Targets 18 Browsers, Crypto Wallets, and Discord Tokens

Lucid Stealer is engineered to pilfer data from virtually every aspect of a user’s digital footprint. The analyzed build is designed to compromise 18 different web browsers, 21 cryptocurrency clipper formats, seven desktop wallets, seven browser-based wallet extensions, and four Discord client variations.

The malware specifically targets saved credentials, session cookies, autofill data, and browser history. It achieves this by utilizing a bundled SQLite tool to directly query copied browser databases.

Beyond browsers, Lucid Stealer injects itself into Discord clients to steal authentication tokens and modify the application to continuously exfiltrate stolen data. It also actively monitors clipboard activity, enabling it to silently replace any copied cryptocurrency wallet address with one controlled by the attacker. These combined features facilitate the simultaneous draining of financial accounts and compromise of communication platforms.

A distinguishing feature of this threat is its sophisticated remote access module, known as HVNC (Hidden Virtual Network Computing). This module grants operators visual control over an infected machine without displaying any visible windows to the victim. Coupled with a remote shell, a file manager, keylogging, and screenshot capabilities, attackers gain nearly identical access as if they were physically present at the compromised system.

Infection Chain and Detection Guidance for Defenders

The infection typically begins with the malware delivered inside a password-protected ZIP archive. Once executed, it initiates a multi-stage setup process, dropping helper files, establishing persistence within the Windows registry, and optionally attempting to gain elevated privileges. By the time the primary payload is decrypted and run, the attacker has already secured a stable foothold on the system.

Security teams should prioritize behavior-based detection strategies over reliance on file hashes, especially given the operators’ announced plans to redevelop the malware on a new platform. Key indicators of compromise include the presence of temporary self-copies in the Windows TEMP folder, often disguised as “winupd” files, suspicious HKCU Run registry entries named “WindowsUpdate,” and unexpected .node module files appearing in user profiles.

Network defenders should block all traffic to known command-and-control (C2) addresses and monitor for recurring POST requests to internal log and upload endpoints, which can serve as additional confirmation of an active infection.

Indicators of Compromise (IoCs)

What You Should Do

• Implement Advanced Endpoint Detection and Response (EDR): Focus on EDR solutions capable of behavior-based detection to identify suspicious process activity, registry modifications, and file creations, rather than relying solely on signature-based antivirus.
• Educate Users on Phishing and Social Engineering: Since the malware often arrives via password-protected ZIP archives, reinforce training on identifying and avoiding suspicious attachments and links, especially those promising software updates or urgent notifications.
• Enforce Strong Password Policies and Multi-Factor Authentication (MFA): Even if credentials are stolen, MFA can significantly reduce the impact of account compromise across all critical services.
• Monitor Network Traffic for C2 Communications: Actively watch for outbound connections to known C2 IP addresses (e.g., 45[.]138[.]16[.]107:3001) and specific URIs like /upload or /internal/log. Implement firewall rules to block these known malicious destinations.
• Regularly Back Up Critical Data: Maintain offline, encrypted backups of all essential data to facilitate recovery in the event of a full system compromise.
• Conduct Regular Security Audits and Penetration Tests: Proactively identify and remediate vulnerabilities that could be exploited by sophisticated malware like Lucid Stealer.
• Isolate and Rebuild Infected Systems: Treat any confirmed infection as a complete compromise. Isolate the affected machine from the network immediately and perform a clean reinstallation of the operating system and applications.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.