Gremlin Stealer Evolves with Advanced Obfuscation, Crypto Clipping

Palo Alto Unit 42 reports a significant evolution in the Gremlin stealer, now employing advanced obfuscation tactics to evade detection. This variant is designed to hide its malicious payload within resource files, a technique that allows it to operate “in plain sight” and bypass traditional security controls that might flag executable files.

The updated Gremlin stealer leverages sophisticated techniques including crypto clipping and session hijacking. Crypto clipping allows the malware to intercept and redirect cryptocurrency transactions, while session hijacking enables it to take over active user sessions, granting attackers unauthorized access to sensitive accounts and data. This combination makes it a potent threat for data compromise.

Defenders need to recognize that file-based detection is no longer sufficient. The move towards hiding payloads in resource files demands a deeper analysis of file content and behavior, not just file type. This variant targets any organization where users handle cryptocurrency or maintain active web sessions, making it a broad threat that requires updated defensive strategies.