Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

This report analyzes a new Gremlin stealer variant that hides payloads in .NET resources using XOR and sophisticated commercial packing, employs identifier renaming, string encryption and control-flow obfuscation, and includes modules for browser cookie/session/token theft, Discord token extraction, a clipboard crypto-clipper, and WebSocket-based session hijacking; the report also provides multiple SHA256 sample hashes and a C2/exfiltration URL and recommends mitigations via Palo Alto Networks products.