# Chasing Eddies: New Rust-based InfoStealer used in CAPTCHA campaigns

Fake CAPTCHA pages trick users into pasting a clipboard PowerShell command that drops EDDIESTEALER, a Rust infostealer harvesting browser, wallet and password-manager data.

- Payout: Real-world hack
- Program: EDDIESTEALER
- Analysis by: Jia Yu Chan
- Disclosed: 2025-05-30
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/eddiestealer
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-eddiestealer
- Tags: area:os domain:desktop impact:data-leak impact:funds-loss kind:incident platform:threat-intel tech:chromium tech:windows technique:reverse-engineering technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Windows hosts; compromised websites serving fake reCAPTCHA pages
**Root cause:** Compromised sites serve obfuscated React JS that mimics reCAPTCHA and uses document.execCommand("copy") to place a PowerShell downloader in the clipboard, socially engineering the user to run it via Win+R. The dropped gverify.js then fetches and executes the EDDIESTEALER binary.
**Steps:**
1. Victim visits compromised site; obfuscated React JS renders fake "I'm not a robot" CAPTCHA.
2. Page calls `document.execCommand("copy")` to place a PowerShell command in clipboard and instructs user to press Win+R, Ctrl+V, Enter.
3. PowerShell downloads `gverify.js` from `hxxps://llll.fit/version/` into Downloads and runs it hidden via `cscript`.
4. gverify.js fetches executable from `hxxps://llll.fit/io`, saves as pseudorandom 12-char filename, executes EDDIESTEALER.
5. EDDIESTEALER creates mutex from UUID, checks physical memory >~4GB (else self-deletes), then GETs `<C2>/api/handler/<UUID>` for AES-CBC/Base64 task config.
6. Malware reads targeted wallet/browser/password-manager/FTP/Telegram paths and POSTs AES-encrypted data per task to `<C2>/api/handler<session_id>/<task_id>`.
7. For Chrome credentials, spawns Chrome with `--remote-debugging-port=<port>`, queries `/json/version`, issues `Target.createTarget` on `chrome://password-manager/passwords`, then scans process memory (ChromeKatz-style) for plaintext.
**How found:** Elastic Security Labs analyzed telemetry from the fake-CAPTCHA delivery chain, deobfuscated the React JS and gverify.js, then reverse-engineered the Rust binary using rustbinsign symbol restoration, XOR string decryption via Binary Ninja UIDF, panic-metadata code segmentation, and TinyTracer API tracing.
**Exploitation:** End-to-end: social-engineered clipboard execution yields a PowerShell stager, then a JS loader, then the Rust stealer. The stealer pulls a task list from C2, exfiltrates crypto wallets, browser data, password managers, FTP configs and Telegram sessions over HTTP POST, and can self-delete via NTFS ADS rename.
**Escalation:** Newer variants add server-side sandbox profiling (withholding config from analysis hosts), hardcoded AES keys, and Chrome DevTools Protocol abuse to force decryption of stored passwords in memory.
**Insight:** Rust panic metadata (source .rs paths, line/column) survives stripping and maps directly to logical modules — use it to segment binaries and locate config/JSON parsers; also, spawning Chrome with --remote-debugging-port and opening chrome://password-manager/passwords forces credential decryption into memory for scraping.

## Proof of concept (copied exactly from the original report)

**PowerShell command copied to clipboard by fake CAPTCHA**

```
This command silently downloads a second-stage payload (gverify.js) from the attacker-controlled domain hxxps://llll.fit/version/ and saves it to the user’s Downloads folder.

Copy PowerShell command to clipboard

Finally, the malware executes gverify.js using cscript in a hidden window.
```

**C2 config message format Base64(IV):Base64(AESEncrypt(data))**

```
The second-stage configuration data is AES CBC encrypted and Base64 encoded. The Base64-encoded IV is prepended in the message before the colon (:).

Base64(IV):Base64(AESEncrypt(data))
```

**Chrome remote debugging spawn and DevTools query**

```
EDDIESTEALER begins its credential theft routine by spawning a new Chrome process with the --remote-debugging-port=<port_num> flag, enabling Chrome’s DevTools Protocol over a local WebSocket interface. This allows the malware to interact with the browser in a headless fashion, without requiring any visible user interaction.

Setting up Chrome process with remote debugging

After launching Chrome, the malware queries http://localhost:<port>/json/version to retrieve the webSocketDebuggerUrl, which provides the endpoint for interacting with the browser instance over WebSocket.
```