Node.js LTX Stealer Emerges as New Threat to Login Credentials

LTX Stealer is a Node.js–based infostealer distributed inside deceptive Inno Setup installers (e.g., Negro.exe) that drops a bundled Node.js payload (updater.exe) to a hidden update-like folder, escalates privileges via LSASS token impersonation to run as SYSTEM, and uses Bytenode bytecode plus large encrypted archives to evade detection; it harvests Chromium browser credentials, cookies, session tokens, and cryptocurrency wallet data, and leverages Supabase and Cloudflare-backed infrastructure with observable domains, IPs, and file hashes while being marketed as low-cost Stealer-as-a-Service.