Lucid Stealer Targets Browsers, Crypto Wallets, Discord Tokens, and Adds Hidden Remote Access

A newly analyzed Windows malware called Lucid Stealer can steal browser data, cryptocurrency wallet information, Discord tokens, Roblox sessions, and other sensitive data while also giving attackers hidden remote access to infected systems.

Security researchers at Foresiet said Lucid Stealer is not just a basic credential thief. Their Lucid Stealer malware analysis found a commercial malware-as-a-service operation promoted through Telegram-linked channels and backed by a web panel, license keys, and customer support.

The analyzed sample targets 18 browsers, 21 cryptocurrency clipper formats, seven desktop wallets, seven wallet browser extensions, and four Discord client variants. It also includes keylogging, screenshots, file management, remote shell access, DDoS support, and HVNC-style hidden desktop control.

Lucid Stealer is packaged inside a legitimate Node.js runtime

The malware arrives as a password-protected ZIP archive. Inside it sits a large Windows x64 executable that looks like a Node.js application but carries a malicious embedded payload.

This packaging matters because Node.js can create single executable applications that bundle JavaScript code into a standalone binary. The official Node.js documentation says this feature lets developers distribute a Node.js application to systems that do not already have Node.js installed.

Lucid Stealer abuses that same general idea as a concealment layer. Foresiet said the inner executable is roughly 100 MB and contains an embedded NODE_SEA_BLOB JavaScript loader of about 8.5 MB, which stages helper components and decrypts the second-stage stealer and remote access payload.

Feature	Observed Lucid Stealer behavior	Risk to victims
Browser theft	Targets saved credentials, cookies, autofill data, and browser history.	Attackers can hijack accounts and reuse stolen sessions.
Crypto theft	Targets wallet files, wallet extensions, and clipboard wallet addresses.	Funds can be stolen or redirected during transactions.
Discord theft	Steals Discord tokens and injects code into Discord clients.	Attackers can take over accounts or spread follow-on attacks.
Hidden remote access	Includes HVNC, remote shell, screenshots, keylogging, and file management.	Operators can control the machine without obvious visual signs.
Persistence	Creates a WindowsUpdate autorun entry under HKCU Run.	The malware can start again after reboot.

The stealer goes after browser credentials and session data

Lucid Stealer uses a bundled SQLite helper to query copied browser databases. That allows it to collect stored logins, cookies, autofill records, and browser history from many Chromium-based and other supported browsers.

This behavior matches a well-known attacker technique. MITRE ATT&CK explains that attackers can acquire credentials from web browsers by reading browser-specific files, including database files that store saved usernames and passwords.

Browser cookies and tokens create a major risk because they can let attackers access accounts without immediately needing the victim’s password again. For businesses, that means a single infected workstation can expose email, cloud storage, collaboration tools, developer accounts, and financial platforms.

Discord, Roblox, and crypto users face extra risk

The malware includes dedicated logic for Discord theft and injection. It can steal tokens from Discord clients and modify client files so stolen data continues to flow back to the attacker.

Lucid Stealer also targets Roblox session data and cryptocurrency assets. Its clipper module monitors clipboard activity and can replace copied wallet addresses with attacker-controlled addresses, although Foresiet said the clipper was present but disabled in the recovered build.

The wallet targeting covers both desktop wallets and browser extensions. That combination makes the malware dangerous for users who manage crypto assets from the same Windows profile they use for browsing, gaming, messaging, and payments.

• Targets include 18 browsers and four Discord client variants.
• The analyzed build includes 21 cryptocurrency clipper formats.
• Seven desktop wallets and seven wallet extensions appear in the configured target list.
• Browser cookies, saved passwords, Discord sessions, Roblox sessions, and wallet material should be treated as exposed after infection.

Hidden remote access makes infections full compromise events

Lucid Stealer’s remote access module makes it more serious than many commodity stealers. The sample includes HVNC-style hidden desktop control, which can let an operator interact with a separate desktop session without displaying a normal window to the victim.

The malware also supports keylogging and screen capture. MITRE ATT&CK describes input capture as a technique where attackers collect user input, including keystrokes, to obtain credentials or other sensitive information.

Combined with a remote shell and file manager, these functions can give attackers broad control after the first run. They can steal files, watch activity, capture credentials as they are typed, issue commands, and potentially stage additional payloads.

Capability	What it enables	Defender priority
HVNC	Hidden desktop control without a visible user window.	Watch for unusual native modules and remote-control behavior.
Keylogger	Captures typed passwords, messages, and sensitive entries.	Force password resets after containment.
File manager	Allows browsing, upload, download, and deletion of files.	Review data access and outbound transfers.
Remote shell	Lets operators run commands on the victim machine.	Hunt for child processes and unusual command execution.
Screenshots	Captures visible activity and sensitive windows.	Assume exposed content may include personal and business data.

The infection chain creates several useful detection points

The infection begins with a password-protected archive and moves through several layers. The Node.js wrapper extracts and runs the embedded loader, writes helper files, creates persistence, attempts elevation, decrypts the main JavaScript payload, and connects to command-and-control infrastructure.

The same Node.js single executable application model can serve legitimate software, so defenders should not block Node.js binaries blindly. Instead, they should focus on suspicious staging patterns, unexpected .node modules, persistence entries, and network behavior tied to unknown executables in user-writable locations.

Foresiet said the operators briefly closed the project in May 2026, then returned with claims of a rebuilt site and a possible future shift from Node.js to Java for better evasion and performance. That means hash-only detection will likely age quickly.

• Look for self-copies named %TEMP%\winupd_<random>.exe.
• Monitor %TEMP%\_sq3e_<pid>.exe for a dropped SQLite helper.
• Review %LOCALAPPDATA%\Common\<id>\*.node for unexpected native addons.
• Alert on HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate pointing to a suspicious loader copy.
• Watch for %TEMP%\Data_<hwid>.zip as a staged exfiltration archive.
• Investigate repeated traffic to /upload, /internal/log, /dc-injector, and /ws endpoints.

Indicators linked to the analyzed Lucid Stealer build

The indicators below come from the analyzed build and related infrastructure context. Security teams should use them as hunting leads together with endpoint behavior, not as the only basis for response.

Type	Indicator	Description
SHA-256	a380e66f381c9f88f4f221906f12b73e1f43517c8e5f6affcaca71fad3340d5f	Outer WinZip-AES password-protected ZIP archive
SHA-256	101351cff5f971cd39bd6280be02a5e0e8f08d9874cae78b971e3a421a7050f6	Inner Windows x64 Node.js SEA executable
SHA-256	8422c48d6301426a39bf9b3d7f11bdbee7708e8a4e58171f38a5b5e51a8a53b8	Embedded NODE_SEA_BLOB JavaScript loader
SHA-256	cad3f0dde70a5d37c996abee75f39aff8e7603862f071a8c85cb48ee5482750f	Decrypted JavaScript stealer and RAT core
IP address	45[.]138[.]16[.]107:3001	Hard-coded command-and-control endpoint in the sample
IP address	85[.]239[.]155[.]68	Resolving infrastructure for lucidstealer[.]one during analysis
Domain	lucidstealer[.]one	User-supplied panel domain
Domain	iloveyoulucid[.]space	User-supplied panel domain observed in infrastructure context
URI	/upload	Stolen-data archive upload endpoint
URI	/internal/log	Metadata and keylog telemetry endpoint
URI	/dc-injector	Discord injection payload retrieval endpoint
URI	/ws	WebSocket C2 communication path
Registry key	HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate	Autorun persistence value pointing to the loader copy

Defenders should treat Lucid Stealer infections as full compromises

Organizations should respond to Lucid Stealer as a full endpoint and identity compromise. Removing the file is not enough because the malware can steal cookies, tokens, passwords, wallet keys, screenshots, typed data, and files before security teams detect it.

After containment, security teams should isolate the host, collect forensic data, revoke sessions, reset passwords, rotate exposed keys, reissue affected tokens, review cloud account activity, and check for unauthorized Discord, Roblox, crypto, email, and business app access.

Teams should also map detections to browser credential theft and input capture behaviors. The MITRE browser credential technique and MITRE input capture technique provide useful references for building stronger monitoring around the actions Lucid Stealer performs.

• Block known C2 infrastructure at the network edge and DNS layer.
• Monitor for unexpected Node.js executables in temporary or user profile paths.
• Alert on unknown .node modules written under %LOCALAPPDATA%\Common.
• Inspect Discord client modifications and token theft behavior.
• Rotate browser sessions and invalidate cookies after infection.
• Reset passwords from a clean device, not from the infected machine.
• Move crypto funds to new wallets if any wallet material was stored on the host.

The Foresiet analysis shows how commodity stealers continue to evolve into hybrid theft and remote-access platforms. For users and businesses, the main lesson is clear: once this malware runs, every browser session, wallet, token, and account used on that Windows profile should be treated as exposed.

FAQ