Threxar has identified an active malware campaign distributing a previously undocumented loader, internally designated StealCraft. The campaign began circulating in mid-September 2026 and targets finance and HR personnel at mid-market businesses.
Initial Vector
The campaign uses a classic spear-phishing approach: spoofed invoice emails from plausible vendor domains (e.g., invoices@[company]-billing.net), with a PDF attachment. The PDF contains an embedded link disguised as a "View Invoice" button that downloads a password-protected ZIP file. The password is printed in the body of the PDF.
Loader Behaviour
Once executed, StealCraft:
1. Decodes an embedded second-stage payload from a Base64 string in its resource section
2. Injects the second stage into a suspended svchost.exe process
3. Establishes persistence via a Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run
4. Beacons to a hardcoded C2 domain over HTTPS, mimicking legitimate Cloudflare traffic headers
The second-stage payload has not yet been fully characterised, but behavioural analysis indicates data exfiltration capability targeting browser credential stores and local file systems.
IOC Block
The following indicators have been confirmed across analysed samples.