Executive Summary
Salat Stealer is a sophisticated information stealer written in Go that has evolved beyond traditional data theft to include real-time surveillance capabilities. It performs deep system reconnaissance and enables live monitoring of victims through desktop streaming and audio/video capture via integrated webcam and microphone access.
Recent campaigns have utilized social engineering within the gaming community, specifically bundling the malware with 'Xeno Executor,' a tool used for Roblox script execution. The infection chain typically involves an obfuscated batch script loader or a Rust-based loader that disables Windows Defender features before dropping the final payload. Once active, the malware targets credentials from dozens of browsers, session tokens for Discord and Steam, and various desktop cryptocurrency wallets.
This threat is particularly significant due to its dual-purpose nature as both a financial harvester and a privacy-violating surveillance tool. Organizations and individuals in the gaming and software development sectors are at heightened risk of compromise leading to session hijacking and asset theft.