ShinyHunters: Silent Malware as a Service (MaaS)

This report analyzes Illusion-2.6.5-setup.exe — a Silent Stealer v2.6.5 build packaged as a fake Electron NSIS installer — detailing extraction steps, three-layer obfuscation, AES-encrypted payloads, active C2 backends, exposed operator panel, extensive IOCs (hashes, domains, IPs, keys), broad credential/session theft (browsers, wallets, Discord, Telegram tdata, Steam, Roblox, TikTok, Minecraft), RAT capabilities (remote PowerShell, filesystem, screenshots, live chat), multiple persistence and UAC bypass methods, and recommended KQL detection rules.