{"id":"CMP-202611-7itszm","kind":"campaign","aliases":[],"related":[],"title":"Fake RØDECaster download site (rodecaster[.]net) found through search results installs SantaStealer, which steals browser passwords, Discord tokens and crypto wallets on Windows (Unit 42)","description":null,"summary":"Unit 42 (reported 5 Nov 2026) saw people searching for 'rodecaster software' land on rodecaster[.]net, a newly registered site posing as RØDE's RØDECaster app download. It serves RODECaster_App_WIN.zip with RODECaster_App_WIN.exe, a packaged Node.js binary carrying the obfuscated Santa Stealer (@Santagrabber). On Windows it steals saved passwords, cookies and form data from 24 Chromium browsers and Firefox, Instagram, Roblox and Tellonym sessions, Exodus and Phantom wallets, screenshots and Discord tokens. It also plants a lasting hook in the Discord desktop app that captures logins, MFA codes and Stripe/Braintree payment requests. It then downloads a second payload from cheatscan[.]club. Victim count and start date: unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-09T21:40:28+00:00","products":[],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Downloads or browsing to rodecaster[.]net, especially hxxps://rodecaster[.]net/downloads/RODECaster_App_WIN.zip; files RODECaster_App_WIN.zip / RODECaster_App_WIN.exe (SHA256 c6077b57eb197b6d4fcc4f04693985378f8a4d990cc4e81777bf16420a28b855); second stage xyzallahuakbar1337.exe from hxxps://cheatscan[.]club (SHA256 503f2291a1200ac7af427f48c43bfc3ad82864c4dfbc85c70daa937ef73bdf87); traffic to cafebabe[.]cc/api/webhooks/, uploads to catbox[.]moe or gofile[.]io; file %LOCALAPPDATA%\\Temp\\__santa_stealer_mutex__.lck; environment variables __santa_elevated, __santaRun, __santa_started; modified Discord app.asar / index.js in %APPDATA%\\discord*.","fix":"Get RØDE software only from rode.com. If the fake installer ran: isolate the PC, reinstall Discord (or remove the injected code) before logging back in, then from a clean device change all browser-saved passwords, sign out all sessions (Discord, Instagram, Roblox, email), reset MFA, and move crypto from Exodus/Phantom wallets to a new wallet with a new seed. Block the listed domains and hashes.","status":"open","published_at":"2026-11-05T00:00:00+00:00","first_seen_at":"2026-11-09T21:40:28+00:00","triaged_at":"2026-11-09T21:40:28+00:00","updated_at":"2026-11-09T21:40:44+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-09T21:42:41Z","path":"tampered-install","entry":"unknown","reason":"Users searching for the RØDECaster app landed on a newly registered fake download site that served a trojanised installer, RODECaster_App_WIN.exe, which the victim ran, but the record does not say how the attacker got into any organisation.","confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-202611':27A '-7':28A '2026':39B '24':87B '42':25A,35B '5':37B 'also':106B 'app':59B,115B 'binari':69B 'browser':15A,89B 'campaign':30B 'captur':117B 'carri':70B 'cheatscan':132B 'chromium':88B 'club':133B 'cmp':26A 'code':120B 'cooki':82B 'count':135B 'crypto':20A 'data':85B 'date':138B 'desktop':114B 'discord':17A,103B,113B 'download':3A,60B,127B 'earli':32B 'early-warn':31B 'exodus':97B 'fake':1A 'firefox':91B 'form':84B 'found':7A 'hook':110B 'instagram':92B 'instal':11A 'itszm':29A 'land':46B 'last':109B 'login':118B 'mfa':119B 'net':6A,49B 'newli':51B 'node.js':68B 'nov':38B 'obfusc':72B 'packag':67B 'password':16A,81B 'payload':130B 'payment':123B 'peopl':41B 'phantom':99B 'plant':107B 'pose':54B 'regist':52B 'report':36B 'request':124B 'result':10A 'roblox':93B 'rodecast':5A,44B,48B 'rodecaster_app_win.exe':65B 'rodecaster_app_win.zip':63B 'røde':56B 'rødecast':2A,58B 'santa':73B 'santagrabb':75B 'santasteal':12A 'save':80B 'saw':40B 'screenshot':101B 'search':9A,42B 'second':129B 'serv':62B 'session':96B 'site':4A,53B 'softwar':45B 'start':137B 'steal':14A,79B 'stealer':74B 'stripe/braintree':122B 'tellonym':95B 'token':18A,104B 'unit':24A,34B 'unknown':139B 'victim':134B 'wallet':21A,100B 'warn':33B 'window':23A,77B","nicknames":["SantaStealer","Santa Stealer","Santagrabber"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["santagrabber","santastealer"],"ptokens":[],"labels":["campaign","earlywarning","high","other"],"campaign_type":"malware","search_a":"'-202611':27A '-7':28A '42':25A 'browser':15A 'cmp':26A 'crypto':20A 'discord':17A 'download':3A 'fake':1A 'found':7A 'instal':11A 'itszm':29A 'net':6A 'password':16A 'result':10A 'rodecast':5A 'rødecast':2A 'santasteal':12A 'search':9A 'site':4A 'steal':14A 'token':18A 'unit':24A 'wallet':21A 'window':23A","search_b":"'2026':39B '24':87B '42':35B '5':37B 'also':106B 'app':59B,115B 'binari':69B 'browser':89B 'campaign':30B 'captur':117B 'carri':70B 'cheatscan':132B 'chromium':88B 'club':133B 'code':120B 'cooki':82B 'count':135B 'data':85B 'date':138B 'desktop':114B 'discord':103B,113B 'download':60B,127B 'earli':32B 'early-warn':31B 'exodus':97B 'firefox':91B 'form':84B 'hook':110B 'instagram':92B 'land':46B 'last':109B 'login':118B 'mfa':119B 'net':49B 'newli':51B 'node.js':68B 'nov':38B 'obfusc':72B 'packag':67B 'password':81B 'payload':130B 'payment':123B 'peopl':41B 'phantom':99B 'plant':107B 'pose':54B 'regist':52B 'report':36B 'request':124B 'roblox':93B 'rodecast':44B,48B 'rodecaster_app_win.exe':65B 'rodecaster_app_win.zip':63B 'røde':56B 'rødecast':58B 'santa':73B 'santagrabb':75B 'save':80B 'saw':40B 'screenshot':101B 'search':42B 'second':129B 'serv':62B 'session':96B 'site':53B 'softwar':45B 'start':137B 'steal':79B 'stealer':74B 'stripe/braintree':122B 'tellonym':95B 'token':104B 'unit':34B 'unknown':139B 'victim':134B 'wallet':100B 'warn':33B 'window':77B","search_c":"","cause_entry":"unknown","cause_path":"tampered-install","disclosures_checked_at":null,"first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-7itszm","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-05-Site-impersonating-RODEcaster-distributes-Santa-Stealer.txt","severity":null,"published_at":"2026-11-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-09T21:40:28+00:00","fetched_at":"2026-11-09T21:40:28+00:00","note":null,"cites":["https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-05-Site-impersonating-RODEcaster-distributes-Santa-Stealer.txt"]}],"documents":[{"id":110073,"url":"https://x.com/Unit42_Intel/status/2119902378648289477","title":"@Unit42_Intel: Unit 42 observed search engine results leading to a site impersonating RØDECaste","kind":"post","source":"x","publisher":null,"text":"Unit 42 observed search engine results leading to a site impersonating RØDECaster that distributed #SantaStealer malware. The Node.js stealer harvests browser credentials, Discord tokens and cryptocurrency wallet info. Details at: https://t.co/9Nq2NKGcxS https://t.co/4wQr1bZXdB\n\nlikes 13 reposts 3","published_at":"2026-11-09T21:18:07+00:00","relation":"describes","confidence":null,"note":null},{"id":110132,"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-05-Site-impersonating-RODEcaster-distributes-Santa-Stealer.txt","title":"Unit 42: Site Impersonating RØDECaster Distributes Santa Stealer","kind":"blog","source":"analyst","publisher":null,"text":"Search results for 'rodecaster software' lead to rodecaster[.]net impersonating RØDE. Serves hxxps://rodecaster[.]net/downloads/RODECaster_App_WIN.zip containing RODECaster_App_WIN.exe (SHA256 c6077b57eb197b6d4fcc4f04693985378f8a4d990cc4e81777bf16420a28b855), a pkg-packaged Node.js 18.5.0 binary with obfuscated Santa Stealer (@Santagrabber). Steals credentials/cookies from 24 Chromium browsers and Firefox, Instagram/Roblox/Tellonym sessions, Exodus and Phantom wallets, screenshots, Discord tokens; injects persistent hook into Discord app.asar intercepting login, MFA, Braintree and Stripe payments. Exfil via Discord webhooks, cafebabe[.]cc/api/webhooks/, catbox[.]moe, gofile[.]io. Second stage hxxps://cheatscan[.]club/xyzallahuakbar1337.exe (SHA256 503f2291a1200ac7af427f48c43bfc3ad82864c4dfbc85c70daa937ef73bdf87). Mutex %LOCALAPPDATA%\\Temp\\__santa_stealer_mutex__.lck; env vars __santa_elevated, __santaRun, __santa_started.","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}