SANTASTEALER · CMP-202611-7itszm · Other
NO FIX YET · SEE WHAT TO DO
Unit 42 (reported 5 Nov 2026) saw people searching for 'rodecaster software' land on rodecaster[.]net, a newly registered site posing as RØDE's RØDECaster app download. It serves RODECaster_App_WIN.zip with RODECaster_App_WIN.exe, a packaged Node.js binary carrying the obfuscated Santa Stealer (@Santagrabber). On Windows it steals saved passwords, cookies and form data from 24 Chromium browsers and Firefox, Instagram, Roblox and Tellonym sessions, Exodus and Phantom wallets, screenshots and Discord tokens. It also plants a lasting hook in the Discord desktop app that captures logins, MFA codes and Stripe/Braintree payment requests. It then downloads a second payload from cheatscan[.]club. Victim count and start date: unknown.
first public Nov 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
No product ranges from the sources yet.
Downloads or browsing to rodecaster[.]net, especially hxxps://rodecaster[.]net/downloads/RODECaster_App_WIN.zip; files RODECaster_App_WIN.zip / RODECaster_App_WIN.exe (SHA256 c6077b57eb197b6d4fcc4f04693985378f8a4d990cc4e81777bf16420a28b855); second stage xyzallahuakbar1337.exe from hxxps://cheatscan[.]club (SHA256 503f2291a1200ac7af427f48c43bfc3ad82864c4dfbc85c70daa937ef73bdf87); traffic to cafebabe[.]cc/api/webhooks/, uploads to catbox[.]moe or gofile[.]io; file %LOCALAPPDATA%\Temp_santa_stealer_mutex_.lck; environment variables __santa_elevated, __santaRun, __santa_started; modified Discord app.asar / index.js in %APPDATA%\discord*.
Posts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.