---
id: "CMP-202611-7itszm"
page: "https://infrastack.ai/live/CMP-202611-7itszm"
kind: "campaign"
aliases: []
title: "Fake R\u00d8DECaster download site (rodecaster[.]net) found through search results installs SantaStealer, which steals browser passwords, Discord tokens and crypto wallets on Windows (Unit 42)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-11-05T00:00:00+00:00"
first_seen_at: "2026-11-09T21:40:28+00:00"
updated_at: "2026-11-09T21:40:44+00:00"
sources: [{"source": "analyst", "url": "https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-05-Site-impersonating-RODEcaster-distributes-Santa-Stealer.txt", "first_seen_at": "2026-11-09T21:40:28+00:00", "cites": ["https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-05-Site-impersonating-RODEcaster-distributes-Santa-Stealer.txt"]}]
exploit_sources: []
---

# Fake RØDECaster download site (rodecaster[.]net) found through search results installs SantaStealer, which steals browser passwords, Discord tokens and crypto wallets on Windows (Unit 42)

Link for people: https://infrastack.ai/live/CMP-202611-7itszm (this .md is for agents)

Unit 42 (reported 5 Nov 2026) saw people searching for 'rodecaster software' land on rodecaster[.]net, a newly registered site posing as RØDE's RØDECaster app download. It serves RODECaster_App_WIN.zip with RODECaster_App_WIN.exe, a packaged Node.js binary carrying the obfuscated Santa Stealer (@Santagrabber). On Windows it steals saved passwords, cookies and form data from 24 Chromium browsers and Firefox, Instagram, Roblox and Tellonym sessions, Exodus and Phantom wallets, screenshots and Discord tokens. It also plants a lasting hook in the Discord desktop app that captures logins, MFA codes and Stripe/Braintree payment requests. It then downloads a second payload from cheatscan[.]club. Victim count and start date: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Cause

How the attacker got in: not disclosed yet (unknown). Users searching for the RØDECaster app landed on a newly registered fake download site that served a trojanised installer, RODECaster_App_WIN.exe, which the victim ran, but the record does not say how the attacker got into any organisation.

How it reached others: their users installed or auto-updated it (tampered-install).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#tampered-install

## How to check

Downloads or browsing to rodecaster[.]net, especially hxxps://rodecaster[.]net/downloads/RODECaster_App_WIN.zip; files RODECaster_App_WIN.zip / RODECaster_App_WIN.exe (SHA256 c6077b57eb197b6d4fcc4f04693985378f8a4d990cc4e81777bf16420a28b855); second stage xyzallahuakbar1337.exe from hxxps://cheatscan[.]club (SHA256 503f2291a1200ac7af427f48c43bfc3ad82864c4dfbc85c70daa937ef73bdf87); traffic to cafebabe[.]cc/api/webhooks/, uploads to catbox[.]moe or gofile[.]io; file %LOCALAPPDATA%\Temp\__santa_stealer_mutex__.lck; environment variables __santa_elevated, __santaRun, __santa_started; modified Discord app.asar / index.js in %APPDATA%\discord*.

## Fix

Get RØDE software only from rode.com. If the fake installer ran: isolate the PC, reinstall Discord (or remove the injected code) before logging back in, then from a clean device change all browser-saved passwords, sign out all sessions (Discord, Instagram, Roblox, email), reset MFA, and move crypto from Exodus/Phantom wallets to a new wallet with a new seed. Block the listed domains and hashes.

## Timeline

- 2026-11-09T21:40:28+00:00 analyst https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-05-Site-impersonating-RODEcaster-distributes-Santa-Stealer.txt

## Documents

- [describes] @Unit42_Intel: Unit 42 observed search engine results leading to a site impersonating RØDECaste https://x.com/Unit42_Intel/status/2119902378648289477
- [describes] Unit 42: Site Impersonating RØDECaster Distributes Santa Stealer https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-05-Site-impersonating-RODEcaster-distributes-Santa-Stealer.txt

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_