Weaponized Code: LTX Stealer Abuses Node.js to Bypass Antivirus

LTX Stealer is a sophisticated Windows credential stealer distributed via a heavily obfuscated Inno Setup installer (e.g., Negro.exe) that embeds a full Node.js runtime and compiles JavaScript into bytecode to evade analysis; it drops an updater.exe payload, uses decrypt.py to extract Chromium browser credentials, cookies and session tokens, hunts for cryptocurrency wallets, and is offered as a low-cost Stealer-as-a-Service using Supabase/Cloudflare infrastructure.