The Ultimate Validation: Making a Hacker’s “Do Not Engage” List

Celestial Stealer is a JavaScript infostealer offered as Malware‑as‑a‑Service on Telegram that exfiltrates browser credentials, cookies, saved payment data, and crypto wallets. Trellix's analysis shows the malware uses heavy obfuscation, can be packaged as Electron/NodeJS apps, and employs anti-VM and anti-analysis checks—including a hardcoded list of usernames and computer names (notably Huntress researcher Jai Minton) that cause the malware to self-terminate to avoid analysis.