Shuyal Stealer has rapidly ascended as one of the most versatile credential theft tools observed in recent months.

First detected in early August 2025, its modular architecture allows it to target an expansive range of web browsers, including Chromium-based, Gecko-based, and legacy engines alike.

Initial indicators of compromise emerged as anomalous network traffic from compromised hosts, where users reported unexplained browser crashes followed by surges in outbound connections to unfamiliar command-and-control (C2) servers.

Point Wild researchers noted that within days of its emergence, Shuyal Stealer had already compromised hundreds of endpoints across multiple industry sectors, including finance, healthcare, and manufacturing.

The malware’s attack vectors are rooted in traditional social engineering techniques, primarily masquerading as software updates or utility installers.

Delivered through phishing emails or malicious advertisements, the installer payload employs a self-extracting archive that unpacks and executes a legitimate system binary alongside an obfuscated DLL loader.

This side-loading mechanism allows Shuyal Stealer to evade common application whitelist solutions.

As the loader executes, it injects the core stealer module into running browser processes, granting it full access to stored cookies, saved passwords, and form-autofill data.

Point Wild analysts identified the use of encrypted strings and API hashing to conceal calls to key Windows functions such as LoadLibrary and GetProcAddress, complicating static analysis by security researchers.

Upon successful injection, Shuyal Stealer begins its payload routines, harvesting credentials from browser SQLite databases and memory.

It supports 19 different browsers, including Chrome, Edge, Firefox, Opera, Vivaldi, Brave, and several lesser-known forks popular in certain regions.

The stealer can also extract banking session tokens and two-factor authentication approvals stored in local cache.

Once collected, data is compressed using a custom ZIP implementation and encrypted with AES-256 in CBC mode before exfiltration.

Traffic analysis shows the malware batching stolen credentials into 512 KB chunks, which are sent over HTTPS to a dynamically generated subdomain for each victim, complicating takedown efforts.

Infection and Loader Mechanism

Shuyal Stealer’s infection mechanism hinges on DLL side-loading and unhooked API calls to maintain stealth.

After decompressing the archive, the loader writes a benign system executable (for example, svchost.exe) into the Windows directory and drops an accompanying malicious DLL in the same location.

The executable is then launched with a crafted registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, ensuring persistence across reboots.

Once the legitimate executable loads, Windows automatically resolves and loads the malicious DLL due to its naming convention match.

Within the DLL’s DllMain, the loader invokes a staged unpacker:-

// Simplified unpack routine
void UnpackAndInject() {
    BYTE* encryptedPayload = LoadResource(MAKEINTRESOURCE(101));
    BYTE* payload = DecryptAES256(encryptedPayload, payloadSize, key, iv);
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, targetPid);
    LPVOID remoteMem = VirtualAllocEx(hProc, NULL, payloadSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(hProc, remoteMem, payload, payloadSize, NULL);
    CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)remoteMem, NULL, 0, NULL);
}

This unpacker decrypts the core stealer module in memory and injects it into the target browser process.

By avoiding writing the primary payload to disk and leveraging legitimate binaries, Shuyal Stealer bypasses many endpoint detection solutions.

The use of API hashing further thwarts heuristic detection, as function names never appear in string tables.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Shuyal Stealer Attacking 19 Browsers to Steal Login Credentials appeared first on Cyber Security News.

Corporate data security faces an unprecedented crisis as new research reveals widespread employee misuse of generative AI platforms.

A comprehensive study examining enterprise browsing behavior has uncovered alarming patterns of sensitive data exposure across organizations worldwide.

The research, based on real-world telemetry from enterprise browsers, demonstrates that artificial intelligence tools have become the primary vector for unauthorized data transfer from corporate environments.

The study exposes how rapidly generative AI has integrated into workplace routines, with 45% of enterprise users now actively engaging with AI platforms.

ChatGPT dominates this landscape, capturing 43% of overall employee usage and representing 92% of all generative AI activity within organizations.

This remarkable adoption rate places AI tools alongside established enterprise categories like email and file sharing in terms of daily utilization.

Most concerning is the scale of sensitive information exposure through these platforms. The research reveals that 77% of employees regularly paste data into generative AI tools, with 82% of this activity occurring through unmanaged personal accounts that bypass corporate oversight.

This behavior has positioned generative AI as the leading channel for corporate-to-personal data exfiltration, accounting for 32% of all unauthorized data movement outside sanctioned environments.

LayerX Security analysts identified these patterns through comprehensive monitoring of enterprise browser activity, providing unprecedented visibility into employee interactions with AI platforms.

Their research methodology involved deploying security solutions directly within user browsers across multiple large-scale enterprises, capturing complete visibility into data flows between corporate systems and external AI services.

The financial and compliance implications are staggering, with 40% of files uploaded to generative AI platforms containing personally identifiable information (PII) or payment card industry (PCI) data.

Similarly, 22% of data pasted into these tools includes sensitive regulatory information. This exposure creates substantial risks for organizations subject to data protection regulations like GDPR, HIPAA, or SOX compliance requirements.

Unauthorized Access Patterns Drive Enterprise Blindspots

The research reveals a critical identity management crisis within enterprise environments, where traditional access controls have failed to contain employee behavior.

Personal account usage dominates high-risk categories, with 67% of generative AI access occurring through unmanaged accounts that exist outside corporate identity systems.

This pattern extends beyond AI tools, affecting business-critical applications including Salesforce (77% non-corporate access), Microsoft Online (68% non-corporate), and Zoom (64% non-corporate).

Even when employees use corporate credentials, authentication weaknesses persist across enterprise systems. The study found that 83% of ERP logins and 71% of CRM access occurs without single sign-on (SSO) federation, effectively treating corporate accounts like personal ones.

This creates massive visibility gaps where sensitive business workflows operate outside IT oversight and security controls.

The copy-paste behavior represents the most dangerous data transfer method, as it bypasses traditional data loss prevention (DLP) systems entirely.

Employees average 46 paste operations daily, with personal accounts generating an average of 15 pastes per day, including at least 4 containing sensitive data.

Popular destinations include ChatGPT, Google services, Databricks, LinkedIn, Snowflake, and Slack, demonstrating how corporate information flows into diverse external platforms through routine productivity activities.

Chat and instant messaging applications compound these risks, with 87% of activity occurring through unmanaged accounts while 62% of users paste PII/PCI data into these platforms.

This combination of high personal account usage and frequent sensitive data exposure makes messaging apps among the most dangerous channels for unauthorized information transfer.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post 77% of Employees Share Company Secrets on ChatGPT Compromising Enterprise Policies appeared first on Cyber Security News.