Executive Summary
WEES Stealer (identified as wees.dll ) is a sophistica ted .NET i nfostealer linked to a Turkish -speaking developer using the alias 'vtu vx.' The m alware tar gets all m ajor brows ers—Chroma te, Brave, Edge, and Firefox—to extract pa sswords, c ookies, cr edit cards , and hist ory. It no tably bypa sses Chrom e’s App-Bo und Encryp tion (ABE) by inject ing a payl oad DLL di rectly int o browser processes and using named pipe s for IPC to retrie ve decrypt ed master keys.
Be yond brows er data, t he malware performs recursive searches f or Discord backup co des and va lidates Di scord toke ns via API before exf iltrating prioritize d account data throu gh webhook s. The mal ware inclu des anti-a nalysis fe atures suc h as daily key deriv ation bas ed on the current da te and aut omated cle anup of te mporary SQ Lite databa se copies.
This thre at is signi ficant due to its cl ear focus on bypassi ng modern security c ontrols an d its comp rehensive victim pro filing, ra nging from hardware specificat ions to re cently vis ited bookm arks. The presence o f Turkish error mess ages and t he acciden tal inclus ion of a p db debug p ath sugges t an activ ely develo ped crimew are kit or leased mal ware.