SantaStealer stuffs credentials, crypto wallets into a brand new bag

SantaStealer is a newly advertised Russian-speaking infostealer (a rebrand of Blueline Stealer) that targets credentials, sensitive documents, and crypto wallets; Rapid7 analysis shows unobfuscated 64-bit DLL samples with basic anti-VM/debug checks, in-memory module loading, HTTP-based exfiltration, and numerous cleartext strings and exported symbols that make analysis straightforward. The developers market basic and premium tiers via Telegram and a Russian forum with affiliate panels (pricing $175/$300 per month), and the report includes IoCs and recommendations to avoid suspicious links, attachments, and social-engineering prompts.