Inside Maranhão Stealer: Node.js-Powered InfoStealer

Maranhão Stealer is an active Node.js-based information-stealer spread through trojanized gaming downloads and social-engineering websites; it installs via an Inno Setup installer, establishes persistence (Run key, scheduled tasks), hides files, performs host and geolocation fingerprinting, captures screens, and uses reflective DLL injection into browsers to harvest credentials, cookies, browsing history and cryptocurrency wallet data before exfiltrating to attacker-controlled endpoints (104.234.65.186 and api.maranhaogang.fun).